Privacy Policy

1. Introduction

1.1 Who we are

This Privacy Policy (this “Policy”) is issued by Mecavoy LC, a Wyoming limited liability company (Wyoming entity ID 2026-002066107), 5830 E 2nd St, Ste 7000 #38404, Casper, WY 82609, United States (“Mecavoy”, “we”, “us” or “our”). Mecavoy is the controller of the personal information described in this Policy.

1.2 Scope

This Policy applies to personal information that Mecavoy collects through the website at mecavoy.com (the “Site”) and through the emails we send, in connection with:

1. the Mecavoy mailing list, described in Section 2; and
2. Advisor Accounts and applications to the Mecavoy Founding Advisor Program (the “Program”), described in Section 3.

This Policy does not apply to the Mecavoy travel planning and booking service, which is scheduled to open to founding advisors for early access in December 2026 and to travelers across the United States in January 2027. That service will be covered by a separate privacy policy. Sections 2.7 and 3.14 describe how we will move information to it, and we will email you at least 30 days before we move information about you.

1.3 Definitions

In this Policy, “personal information” means information that identifies, relates to or could reasonably be linked with an identified or identifiable individual, including the hashed values described in this Policy. “Offer Terms” means the Pre-Launch Offer Terms, and “Program Terms” means the Founding Advisor Program Terms. “Advisor Account” means an account created at mecavoy.com/advisor/signup to apply to and take part in the Program; “Advisor Console” means the signed-in area of the Site at mecavoy.com/advisor/dashboard; and “Mecavoy Service” means the Mecavoy travel planning and booking service described in Section 1.2.

1.4 How to contact us

Questions about this Policy and requests about your personal information may be sent to privacy@mecavoy.com. Other questions may be sent to support@mecavoy.com.

2. The Mailing List

2.1 Information you provide

1. Email address. Your email address is the only personal detail requested on the signup form. The form also has the two checkboxes described below.
2. Consent record. The exact wording displayed beside the consent checkbox, the version of that wording, the date and time you submitted the form with the box checked, and how your consent was given: through the web form and, for a signup made from the publication of Version 2.5 of this Policy, confirmed with the link in the email we send to the address entered. Signups made under Versions 2 to 2.4 of this Policy had no separate confirmation step, except when an address that had unsubscribed rejoined the mailing list, as described in Section 6(b).
3. Age confirmation and acceptance of the Offer Terms. For a signup made from the publication of Version 2.5 of this Policy, your confirmation, which the signup form requires, that you are 18 years of age or older and that you agree to the Offer Terms, together with the version of the Offer Terms you accepted, the version of the wording of that checkbox, and the date and time you submitted the form with it checked.

When you submit the signup form, we email the address you entered a link to confirm it. Your signup becomes a subscription, and the Free Year of Mecavoy Plus is reserved for the address as the Offer Terms provide, only when that link is used. If the address is entered in the signup form again before it is confirmed, we send another confirmation email, but we send no more than three confirmation emails to the same address in any 24 hours. A signup that is not confirmed is kept and deleted as described in Section 6(c). If the address has unsubscribed from the mailing list, Section 6(b) applies instead.

2.2 Information collected automatically when you subscribe

1. Hashed IP value. A hashed value derived from your IP address, computed with a secret key that we hold. Without that key the value does not reveal your IP address, but we treat it as personal information. Your IP address itself is not stored in your subscriber record.
2. User agent. The user agent string your browser sends, which identifies the browser and operating system.
3. Source page. The page of the Site from which you subscribed.
4. Location check. The country, and for some countries the region, in which our content delivery network places your request, based on its IP address, when you submit the signup form. We use it only for the check described in Section 8.4, and we do not store it.

The signup form also sends the time at which the page was loaded, so that we can see how quickly the form was submitted, which can be a sign of an automated submission. We do not store it in your subscriber record. A submission made unusually quickly is recorded in our application logs (see Section 2.4(b)) with the hashed IP value.

2.3 Information we generate

Your subscription status and the date you first signed up. Until you confirm your email address: when you last submitted the signup form, counting only the submissions we answered with a confirmation email, and when we last sent you a confirmation email, how many we have sent in the current 24-hour period, a one-way hash of the single-use link in the latest one (we do not keep the link itself) and when that link stops working. When you confirm: the date and time you did so and a hashed value derived from the IP address from which you used the link. After that: the date and time we last emailed you, and technical references used to prevent the same email being sent twice; whether the welcome email has been sent; whether a receiving mail server refused an email to you, and the reason it gave; and, if you unsubscribe, the date and time you did so. If you subscribed while Version 1 of this Policy was published, which also required a confirmation email, or if you rejoined the mailing list after unsubscribing as described in Section 6(b), your record may also show when you clicked the confirmation link and a hashed value derived from the IP address from which you clicked it.

2.4 Server and application logs

1. Web and storage access logs. The content delivery network that serves the Site, and the storage that receives files uploaded through the application form, keep standard access logs. These logs include the IP address from which each request was made, the page or file requested, including the parameters of the link used (for an unsubscribe link, a link to confirm a signup or a link to claim the Free Year, these include your email address, encoded but not encrypted), the date and time, and technical details such as the user agent. We use them only for security and diagnostics. They are not combined with subscriber or applicant records and are not used for marketing. Some of our emails include a countdown image that your email program loads from the Site when it displays the email; that request carries no identifier for you, and it is logged, with the IP address it comes from, like any other request to the Site.
2. Application logs. The systems that handle signups, unsubscribes, Advisor Accounts, applications, emails and staff access to the administration console record events such as a signup, a confirmation, a declined signup, an unsubscribe, a sign-in to an Advisor Account, a document being opened or an error. Log entries may include IP addresses and hashed values derived from IP addresses and email addresses and, for a sign-in to an Advisor Account from a new browser, the approximate country described in Section 3.11(i). We use these logs for security, auditing and troubleshooting.
3. Audit logs. We keep an audit log of changes made to our systems, including changes to the records we use to limit attempts to sign in to the administration console. Those entries may include a hashed value derived from the IP address from which an attempt was made. We use the audit log only for security and auditing.
4. Security monitoring. Our hosting provider’s threat-detection service automatically analyzes the record of administrative actions taken in the hosting account in which our systems run, requests to our storage (including the IP address from which an application document is uploaded or opened) and the network activity of our systems, to detect malicious or unauthorized activity. It records a finding only when it detects such activity. A finding may include the IP address involved and the approximate location and network provider that the service associates with it. The provider’s security posture service, which checks the configuration of our systems against security standards, keeps a copy of each finding. The provider’s configuration recording and access analysis services record and check how our systems are set up; they do not analyze requests made to the Site. Files uploaded through the application form are also scanned for malware. When a finding reaches a set level of severity, or malware is found in an uploaded file, an alert is emailed to an operations mailbox used only by authorized Mecavoy staff. An alert gives the type and title of the finding and the system or file concerned, and may include an IP address or the reference under which an uploaded file is stored, but not the file’s name or contents. We use findings and alerts only for security.

2.5 Information we do not collect for the mailing list

For the mailing list, we do not collect your name, date of birth, postal address, phone number, payment details, precise location or advertising identifiers. We do not buy email lists, and we add to the mailing list only addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.

2.6 How we use this information, and our legal bases

1. To send you the emails you agreed to receive (launch news, occasional updates, and Mecavoy promotions and offers), once you have confirmed your email address. Legal basis: your consent, which you may withdraw at any time by unsubscribing. Withdrawing consent does not affect processing carried out before you withdrew it.
2. To reserve and apply your Free Year of Mecavoy Plus under the Offer Terms, once you have confirmed your email address, and to apply the one-per-person limit, for which we treat email addresses that differ only by dots or by a “+” tag as the same address. We continue to do so after you unsubscribe, using the email address kept on the suppression list described in Section 6(b). Legal basis: performance of our agreement with you under the Offer Terms.
3. To detect and prevent automated or abusive submissions and to keep the Site secure, using the information in Sections 2.2 and 2.4, and to check that the domain of the address you enter can receive email. Legal basis: our legitimate interest in operating a secure service. You may object to this processing (see Section 9).
4. To record the page of the Site on which you subscribed, using the source page, as part of the record of how you gave your consent. Legal basis: our legitimate interest in showing that we have acted lawfully.
5. To keep a record of your consent, of your age confirmation and acceptance of the Offer Terms, and of any unsubscribe request, and to maintain a suppression list so that we do not email you after you have unsubscribed, except as described in Section 6(b). Legal basis: our legitimate interest in demonstrating that we have acted lawfully and in honoring your request not to be contacted, and compliance with our legal obligations.
6. To confirm a request to rejoin the mailing list after you have unsubscribed, by sending one email to the address entered in the signup form, as described in Section 6(b). Legal basis: our legitimate interest in making sure that an address is added back to the mailing list only by the person to whom it belongs, and, once you confirm, your consent.
7. To confirm your email address when you sign up, by sending the confirmation emails described in Section 2.1 to the address entered in the signup form. Legal basis: our legitimate interest in making sure that an address is added to the mailing list only by the person to whom it belongs, and, once you confirm, your consent.
8. To offer the mailing list only to adults, and not in the places listed in Section 8.4, using your age confirmation and the location check described in Section 2.2(d). Legal basis: our legitimate interest in choosing whom we offer the mailing list and the Offer to, and, for your age confirmation, performance of our agreement with you under the Offer Terms.

Your email address is required to join the mailing list, and so are the two checkboxes on the signup form. If you do not provide them, we cannot add you to the list or reserve a Free Year for you. This Section 2, together with Sections 4, 6, 8 and 9, is our notice at collection for subscribers.

2.7 Moving the mailing list to the Mecavoy Service

We intend to move the mailing list to the Mecavoy Service, which is operated by Mecavoy LC, shortly before it opens to travelers across the United States, which is scheduled for January 2027. Mecavoy LC remains the controller of your personal information. We will email every subscriber at least 30 days before the move. That email will say when the move is planned, link to the privacy policy of the Mecavoy Service and name the service providers that will hold the information moved. Until the move, you may unsubscribe or ask us to delete your information as described in Section 9.

1. What moves. For each address on the mailing list or kept on the suppression list described in Section 6(b): the email address; the same address with any dots and any “+” tag removed from the part before the “@”, used only to apply the one-per-person limit described in Section 2.6(b); whether the address is subscribed, has unsubscribed or cannot receive our emails, including whether it is on our email delivery provider’s suppression lists described in Section 4.2(b); the dates on which you signed up, confirmed your email address and unsubscribed; the version, date and method of the consent you gave to our emails; the version of the Offer Terms you accepted and the date you accepted them; and the Free Year of Mecavoy Plus reserved for the address. We move each of these only where we still hold it under Section 6.
2. What does not move. The hashed IP values, the user agent and the source page described in Section 2.2, the technical references we use to send emails, signups that were never confirmed, and requests to rejoin the mailing list.
3. After the move. From the move, the privacy policy of the Mecavoy Service applies to the information moved. We will use the information moved for an address that has unsubscribed only to apply the Free Year of Mecavoy Plus reserved for it and to make sure that it is not sent marketing emails. We delete the records described in this Section 2 from the systems we use before launch within 30 days after the move, except that logs and backups are deleted when the periods stated in Section 6 end.

3. Founding Advisor Applications and Advisor Accounts

3.1 Scope of this section

This Section 3 applies to Advisor Accounts created at mecavoy.com/advisor/signup and to applications to the Program made through the application form at mecavoy.com/advisor/apply. The Program Terms are published at mecavoy.com/advisor-terms.html. Independent Agents may apply from the countries listed on the application form, and the Registered Advisor track is open only to individuals who reside in the United States, applying for businesses organized or registered there, as set out in Section 3 of the Program Terms. Sections 4 to 12 of this Policy apply to holders of Advisor Accounts and to applicants as well as to subscribers. This Section 3, together with Sections 4, 6, 8 and 9, is our notice at collection for holders of Advisor Accounts and for applicants.

3.2 Information you provide

1. Identity and contact details. Your full name, your email address (for an application made through an Advisor Account, the email address of that account), phone number (if you provide one), city and country of residence, and your state, province or region where the application form asks for it or you provide it.
2. Professional details. The track you apply for (Independent Agent or Registered Advisor), your headline, years of experience, a description of your work, specialties, destinations, languages and the services you offer, and, if you provide them, your website, Instagram and LinkedIn profiles and the name of your host agency.
3. Business details. For the Registered Advisor track, your business’s legal name, entity type and state of registration, and your seller-of-travel registration numbers and the states that issued them.
4. Headshot and documents. Your headshot and the documents you upload, which may include business registration documents, seller-of-travel certificates, proof of errors and omissions insurance, certificates or training records, and samples of your work, together with each file’s name, type and size. Each file is uploaded to our storage when you select it, before you submit the application.
5. Acceptances and choices. The version of the Program Terms you accepted, your authorization of the verification described in the Program Terms, your confirmation that you meet the age and sanctions requirements of the Program Terms, and your confirmation that the information you provided is accurate, each with the date and time you gave it, together with the wording of each of those confirmations (for an application submitted before Version 2.5 of this Policy was published, the wording of the age and sanctions confirmation only); whether you asked to receive advisor news; and, if you did, the wording of that request and the date and time you made it.
6. Other information. Any other information you give us during our review, including in emails and verification calls.

We do not ask for a passport, national identity card or driver’s license number, a Social Security or other tax identification number, or payment details when you apply.

3.3 Information collected automatically

When you submit an application, we collect a hashed value derived from your IP address and your browser’s user agent, as described in Section 2.2, the identifier of your Advisor Account, and a random identifier that your browser gives the submission, so that a submission repeated after a lost connection does not create a second application. The access logs and application logs described in Section 2.4 also record your use of the application form. Draft answers saved in your own browser while you complete the form are not sent to us until you submit the application (see Section 5.2). We also record the country from which you submitted the application, as determined by our content delivery network from your IP address. We store the country only, not the IP address, and use it to help detect fraud and to check the application against U.S. sanctions requirements. The network may also give us the state, province or region it associates with your IP address; we use that only for the same check and do not store it.

3.4 Information from other sources

When we verify an application, we may obtain information confirming whether the information you provided is accurate from the bodies that issued a certificate, registration or license you have submitted, from public registers, and from any references you have given us. We may also review the website and social media profiles you list in your application and publicly available information about your travel business. We check each applicant’s name and country, and for the Registered Advisor track the name of the business, against the sanctions and other restricted-party lists published by the U.S. government, using government search services such as the Consolidated Screening List or the Office of Foreign Assets Control’s Sanctions List Search.

We do not obtain consumer reports from consumer reporting agencies. If you live outside the United States, we do not search public records about you, other than to confirm a credential you have submitted with its issuer or a public register and to check the sanctions lists as described above, and we do not obtain criminal records or court records about you. If we ourselves obtain public records about you in the course of verification, we will send a copy of them to the email address in your application within seven days after we obtain them, as set out in Section 5.4 of the Program Terms. You do not need to ask for the copy.

During a verification call we may ask you to show an official photo identity document. We look at it only to confirm your identity and that you meet the eligibility requirements of the Program Terms. We do not record the call or keep an image or copy of the document unless you agree or the law requires it, and we do not use facial recognition or other automated means to compare your headshot with it.

3.5 Information we generate

A record of our review, including any note recorded with our decision, our decision, the role approved (if any), the date of each step, the staff account that made each decision, the checks recorded when an application is approved, the flags our systems add to help reviewers (for example, where the country you give differs from the country from which the application was submitted, or where your phone number carries the country code of a Restricted Territory under the Program Terms), the results of the sanctions screening described in Section 3.4, including any note resolving a possible match, and a history of the submission, each decision and any withdrawal; the identifier of the Advisor Account linked to the application and the date it was linked, and, if that account accepted a later version of the Program Terms than the one accepted with the application, that version and the date and time the account accepted it; if we decline the application, the date from which you may apply again and whether we allowed you to apply sooner; if the application replaces one that we declined, a summary of the declined application (its dates, our decision, any note recorded with it and its sanctions screening records); a count of any later attempts to submit an application with the same email address; and the dates on which we sent you emails about your application.

3.6 How we use this information, and our legal bases

1. To review and verify your application, and to communicate with you about it, so that we can make sure that advisors on Mecavoy are who they say they are and hold the qualifications they claim. Legal basis: taking steps at your request before entering into the Advisor Agreement with you, and our legitimate interest in verifying advisors and preventing fraud.
2. To screen applicants against U.S. government sanctions lists and to comply with the laws that apply to us, including U.S. sanctions and tax laws. Legal basis: our legitimate interest in complying with the laws that apply to us and, where the law of the country in which you live imposes the obligation, compliance with a legal obligation.
3. If your application is approved, to prepare your advisor profile, to enter into the Advisor Agreement with you and to apply the provisions of the Program Terms that depend on where you live. Legal basis: taking steps at your request before entering into a contract.
4. To keep a record of the terms you accepted, your authorizations and confirmations, and our decisions, and to establish, exercise or defend legal claims. Legal basis: our legitimate interest in showing that we have acted lawfully and in protecting our legal position.
5. To detect and prevent automated, fraudulent or abusive submissions and to keep the Site secure, including by comparing the country you give with the country from which your application was submitted and with your phone number’s country code. Legal basis: our legitimate interest in operating a secure service and preventing fraud.
6. To send you occasional Mecavoy news for advisors, if you asked to receive it. Legal basis: your consent, which you may withdraw at any time by asking us to stop these emails. Withdrawing consent does not affect processing carried out before you withdrew it.

Where we rely on our legitimate interests, you may object (see Section 9). We do not rely on your consent for verification. The application form asks you to authorize the verification described in the Program Terms. Decisions on applications are made by Mecavoy staff. We do not make decisions about applicants based solely on automated processing. The information marked as required on the application form is necessary for us to consider your application. Other information is optional.

3.7 Internal notification

When you submit an application, a copy of the information in it, other than the uploaded files, is emailed to an internal Mecavoy mailbox so that authorized staff can review it. Applications and uploaded files are otherwise accessed through our password-protected administration console. When an application is withdrawn, or deleted with its Advisor Account, we email the same mailbox a notice giving the applicant’s name, the application’s reference and track and the date of the withdrawal or deletion, so that staff can delete the earlier notification as described in Section 3.8. If records of the application are kept under the item on sanctions screening records in Section 3.8, the notice also says so and states how long they are kept. We delete the notice within 30 days after it is sent.

3.8 How long we keep application information

1. Applications under review. For as long as the review continues.
2. Approved applications. For as long as you are a Mecavoy advisor, and afterwards for as long as the Advisor Agreement or applicable law requires.
3. Declined applications. The documents you uploaded are deleted automatically no later than 12 months after the date of our decision. The rest of the application record is kept only for as long as reasonably necessary to answer questions about the decision, to consider a future application from you, to comply with our legal obligations and to establish, exercise or defend legal claims. If you apply again, a summary of the declined application, including our decision and its sanctions screening records, is kept with the new application for the periods that apply to it, and the documents uploaded with the declined application are deleted when the new application is submitted.
4. Applications withdrawn or deleted. If you withdraw your application in the Advisor Console, we delete the documents uploaded with it immediately, and the rest of the application and our internal notification of it within 30 days. If you delete your Advisor Account, we delete your application and the documents uploaded with it immediately, and our internal notification of it within 30 days. If you withdraw your application by email, or ask us to delete it, we delete the application, its documents and our internal notification within 30 days after we receive your request. A withdrawn application, including its sanctions screening records, is not carried into a later application. In each case, this is subject to the item on sanctions screening records below and to any other legal requirement to keep them.
5. Files not submitted with an application. Files uploaded through the application form but never submitted with a completed application are deleted automatically three days after upload; the deletion can take a few more days to complete.
6. Sanctions screening records. A record of each screening (the date, the list searched, the names searched, the result, the staff account and any note) is kept with the application for the periods in (a) to (d). If you sign the Advisor Agreement, we keep screening records for at least 10 years after our last transaction with you, consistent with U.S. sanctions recordkeeping rules. If a screening confirms that you are on a U.S. government sanctions list, we keep the screening records, and the information in your application needed to identify you and to show what was screened and decided, for 10 years after that confirmation or for any longer period that U.S. sanctions law requires, even if you withdraw the application, your Advisor Account is deleted or you ask us to delete the application. Your documents, the rest of the application and our internal notification of it are deleted as (a) to (e) otherwise provide, including when you withdraw the application in the Advisor Console or your Advisor Account is deleted during that period. If you withdraw the application in the Advisor Console during that period, what we keep under this item stays linked to your Advisor Account, so that the Advisor Console shows the application as withdrawn, until the account is deleted or you ask us to delete the application.

When a document is deleted, our storage provider may keep it in the storage version history for up to 7 days before it is permanently removed; the removal can take a few more days to complete. Deleted application records may remain in encrypted database backups for up to 35 days. We do not make or keep copies of identity documents shown on a verification call unless you agree or the law requires it (see Section 3.4). Please do not upload an identity document with your application; if you do, we delete it.

3.9 Withdrawing an application

As Section 15 of the Program Terms provides, you may withdraw your application at any time before you sign the Advisor Agreement, in the Advisor Console or by emailing support@mecavoy.com from the email address of your application, which for an application made through an Advisor Account is the email address of that account. After you sign the Advisor Agreement, Section 16.4 of the Program Terms applies instead. Section 4.7 of the Program Terms sets out when you may apply again after you withdraw an application or after we decline one. To exercise any of the rights described in Section 9, email privacy@mecavoy.com.

3.10 Advisor Accounts: information you provide

To apply to the Program you must create an Advisor Account. When you do, you give us your first and last name, your email address and a password, and you confirm, by checking a box, that you are 18 years of age or older and an adult where you live, and that you agree to the Program Terms. We keep a record of the wording of that box with your account. We store your password only as a salted, one-way cryptographic hash, computed with the scrypt algorithm. We cannot read or recover your password.

Advisor Accounts are available only to people who are 18 years of age or older (or the age of majority where they live, if higher) and who live in a country where the Program is open, which is the list of countries on the application form. We ask for your country when you create an Advisor Account, check it, and do not keep it on our systems. We also do not open an Advisor Account when our content delivery network places the request, from its IP address, in a Restricted Territory under Section 3.3 of the Program Terms that the network can identify, which at the date of this version means Cuba, Iran, North Korea, Syria, Russia, Belarus, mainland China (not including Hong Kong, Macao or Taiwan) and the Crimea region of Ukraine, including the city of Sevastopol, whatever country you give. The network cannot tell whether a request from elsewhere in Ukraine comes from the so-called Donetsk People’s Republic or Luhansk People’s Republic regions, so we check that when you apply, as described in Section 3.3 of this Policy. We use that location only for these checks and do not store it at sign-up. Your own browser keeps the country you choose for a short time so that the application form can fill it in (see Section 5.2(b)).

3.11 Advisor Accounts: information we collect and generate

1. Verification. A six-digit code that we email to you to confirm your email address. The code expires 15 minutes after we send it, and we do not store it. Until you enter the code, and for no more than one hour, we use the details you gave when you signed up, which we keep with your password only as a salted, one-way hash that is itself encrypted, together with your browser’s user agent, a hashed value derived from your IP address and the information needed to check the code and limit attempts. We delete them as described in Section 3.13(a). If someone tries to create an Advisor Account with an email address that already has one, we send that address an email saying so instead of a code.
2. Account record. An account identifier; the dates on which the account was created, your email address was confirmed and your password was last changed; the time of your latest sign-in; the versions of the Program Terms and of this Policy presented when you created the account, when you accepted the Program Terms, and the wording of the box you checked to accept them; whether the account is active or suspended, and whether you must choose a new password before you next sign in; and a hashed value derived from your IP address, and your browser’s user agent, recorded when you created it.
3. Sessions. For each browser signed in to your account, up to ten at a time: a random session identifier, a description of the browser and operating system (for example, “Chrome on Windows”), a hashed value derived from your IP address, and when the session started and was last used.
4. Security records. Up to 20 recent security events, such as sign-ins, password changes, changes to two-step sign-in, withdrawals and changes that Mecavoy support makes at your request or to protect your account, each with its date and time and, where it applies, the browser description and a hashed IP value, which you can view in the Advisor Console; and counts of failed sign-in, verification, password reset and two-step sign-in attempts, and of requests such as sign-ups, verification codes and document uploads, which we use to limit guessing and abuse. These counts are identified only by a hashed value derived from your IP address, a keyed hash of your email address or your account identifier.
5. Password resets. When you ask to reset your password, the email address you entered and a hash of the single-use reset link, which works for 30 minutes. If the address has no Advisor Account, we send no email and remove the address from the request.
6. Breached password check. When you choose a password, our servers compute a hash of it and send the first five characters of that hash to the Pwned Passwords service operated by Have I Been Pwned, which returns a list of hash fragments from known data breaches. The comparison is made on our servers. We do not send your password, the full hash, your email address or any other information that identifies you. We also compare your password with a list of common passwords kept on our servers.
7. Devices. For each browser you sign in from, up to 20 browsers: a keyed hash tied to your account (not usable as a cookie and not linkable to other accounts), the browser description, and when it was first and last used. A browser that has not been used to sign in for 180 days is treated as new again (see Section 3.13(f)).
8. Two-step sign-in. If you turn it on: the secret shared with your authenticator app, encrypted; one-way hashes of your ten recovery codes, each of which works once; the time step of the last code used, so that no code can be used twice; and, while you are setting it up, the pending secret, encrypted, and a six-digit code that we email to you, which we do not store. We count consecutive wrong codes, and email you when someone who knows your password enters three wrong codes in a row. After 100 wrong codes in a row, two-step sign-in is locked until your password is changed or reset.
9. Approximate location. When you sign in from a browser we have not seen for your Advisor Account, or when three wrong two-step codes in a row are entered for it, the country in which our content delivery network places the request, based on its IP address. We use it only in the email that tells you about the event, and our application logs record it with a sign-in from a new browser (see Section 2.4(b)). We do not keep it in your account record.
10. Applications in the last 12 months. The identifier and date of each application you made in the last 12 months, kept with your account to apply the limit on applications in Section 4.7 of the Program Terms. An entry more than 12 months old is no longer used for that limit, and is removed the next time the list is updated or when your account is deleted.

3.12 How we use Advisor Account information

We use this information to create and secure your Advisor Account; to confirm your email address; to let you sign in, apply, see the status of your application, withdraw it, apply again and manage or delete your account; to link an application made before Advisor Accounts were available to the Advisor Account that uses the same confirmed email address, and to show its status, track and dates in the Advisor Console; to send you account and security emails (verification codes, notices that an email address already has an account, password reset links, notices of password changes, new sign-in alerts, alerts about wrong two-step codes, two-step sign-in changes and codes, notices of withdrawals and account deletion, and notices of changes support makes at your request, such as a changed sign-in address), which are part of the service and are sent regardless of your marketing choices; to detect and prevent unauthorized access and abuse; to keep a record of your acceptance of the Program Terms; to apply the rules on applying again in Section 4.7 of the Program Terms; and to move your account to the Mecavoy Service as described in Section 3.14.

Account log-in credentials are “sensitive personal information” under California law. We collect and use them only to provide and secure your account, which are permitted purposes under the California Consumer Privacy Act regulations, and we do not use them to infer characteristics about you.

3.13 How long we keep Advisor Account information

1. Sign-ups. Sign-ups that are not confirmed within one hour are deleted automatically, usually within a few days. A confirmed sign-up is deleted when the Advisor Account is created.
2. Account records. Account records are kept until you delete your Advisor Account, or we delete it at your request or close it under the Program Terms, subject to Section 3.14.
3. Sessions. A session ends when you sign out, after 60 minutes without activity, or 12 hours after you sign in, whichever comes first. Signing out everywhere, resetting your password and certain actions by Mecavoy support end all of your sessions; changing your password or turning off two-step sign-in ends all of them except the one you are using. Information about a session is removed from your account record when the session is ended in one of these ways or by signing out, and otherwise the next time you sign in after the session has ended.
4. Counts of attempts and reset requests. Counts of attempts and requests expire no later than 24 hours after the last attempt or request they count, except that counts of consecutive failed sign-ins and of consecutive wrong two-step codes expire 30 days after the last failure. A completed sign-in clears the count of failed sign-ins kept for your email address, and a completed sign-in with two-step sign-in also clears the counts of wrong two-step codes kept for your account. A password reset clears the count of failed sign-ins and the count of consecutive wrong two-step codes. A reset request is deleted when its link is used, and otherwise expires after 30 minutes. Expired counts and reset requests are deleted automatically, usually within a few days.
5. Deleting an Advisor Account. When your Advisor Account is deleted, whether by you in the Advisor Console, by us at your request or when we close it under the Program Terms, we delete your account record, your application and the documents uploaded with it, and any pending password reset request, subject to the item on sanctions screening records in Section 3.8, under which we may keep the screening records of your application and the information in it needed to identify you and to show what was screened and decided, but not the documents uploaded with it. We keep the record of the deletion described in (h) for 24 months, which also lets us apply the deletion to the copy of your account moved to the Mecavoy Service (see Section 3.14). If the Program Terms would still limit when you may apply again, we also keep, until that limit ends, a record identified only by a keyed hash of your email address, stating the date from which you may apply again and the dates of your applications in the last 12 months. Logs and backups are kept as described in Section 6.
6. Devices. A device entry is updated each time you sign in from that browser. An entry that has not been used for 180 days is no longer treated as known, and is removed from your account record the next time you sign in, or when your account is deleted. When you sign in from more than 20 browsers, the entry used least recently is removed.
7. Account emails. The records we keep to send account and security emails hold your email address, your name and, where the email needs them, the browser description and approximate country described in Section 3.11(i) and details of your application such as its reference and track. They hold these details only until the email is sent or, if it cannot be sent, until the record is deleted, and they are deleted automatically no later than seven days after they are created; the deletion can take a few more days to complete.
8. Records of requests and support actions. When your Advisor Account is deleted, we keep a record of the deletion (the account identifier, the date, how the deletion was requested and whether records of an application were kept under the item on sanctions screening records in Section 3.8, with no contact details) for 24 months, the period California’s privacy regulations set for records of consumer requests, so that we can show how we handled the request. We also keep, for 24 months, a record of each action Mecavoy staff take on an Advisor Account at your request or to protect it, such as providing a copy of your information, changing your sign-in email address or suspending the account, with a short note of the reason, identified only by the account identifier and a keyed hash of the email address.

3.14 Moving your Advisor Account to the Mecavoy Service

We intend to move each Advisor Account to the Mecavoy Service, which is operated by Mecavoy LC, before the Mecavoy Service opens to founding advisors for early access, which is scheduled for December 2026, so that you can sign in there with the same email address and password. Mecavoy LC remains the controller of your personal information. We will move your name, email address, account identifier, the one-way hash of your password described in Section 3.10 (never the password itself, which we do not have), the dates on which your account was created, your email address was confirmed and you last signed in, the Program Terms version you accepted and the record of the box you checked to accept them, your account status, whether you must choose a new password, whether two-step sign-in is turned on, the dates of your applications in the last 12 months and any date before which you may not apply again, and your application, together with the documents uploaded with it that we still hold. We will not move the secret shared with your authenticator app or your recovery codes: if you use two-step sign-in, you will set it up again when you first sign in to the Mecavoy Service. If a record described in Section 3.13(e) still limits when an email address may apply again, we may move it too, identified only by a keyed hash of the address. We will not move your sessions, device entries or security records, or the hashed IP values and user agents described in Sections 3.3 and 3.11: you will sign in again, and alerts about new browsers will start afresh. We will email you at least 30 days before the move, and that email will name the service providers that will hold the information moved. You may delete your account before then. When you first sign in to the Mecavoy Service, you will be asked to accept its terms, and its privacy policy will apply from then. We delete the pre-launch account records within 30 days after the move, except the records described in Section 3.13(e) and (h), which we keep for the periods stated there.

4. How We Disclose Personal Information

4.1 No sale or sharing for advertising

We do not sell personal information, share it for cross-context behavioral advertising, or disclose it to third parties for their own marketing. We have not done so in the preceding 12 months.

4.2 Service providers

The following service providers process personal information on our behalf, for the purposes described. The providers in (a) to (d) do so under contract and only for those purposes; the provider in (e) does so under its standard terms of service:

1. Amazon Web Services (AWS). Hosts the Site, the databases that hold subscriber, Advisor Account and application records, the storage that holds application documents, the keys that encrypt them, and our logs, in the United States, and provides the security monitoring, and sends the security alerts, described in Section 2.4(d). The AWS services we use for this include Amazon CloudFront, which delivers the Site and determines the approximate location described in Sections 2.2(d), 3.3, 3.10 and 3.11(i); AWS WAF, which filters requests to the Site; AWS Lambda and Amazon API Gateway, which run our systems; Amazon DynamoDB and Amazon S3, which store our records and documents; AWS Key Management Service, which holds our encryption keys; Amazon CloudWatch and AWS CloudTrail, which keep our logs; Amazon GuardDuty, which monitors our systems and scans uploaded files for malware; AWS Security Hub, AWS Config and IAM Access Analyzer, which check how our systems are set up; and Amazon Simple Notification Service, which sends the security alerts.
2. Mailgun (Sinch). Delivers the emails we send to subscribers and applicants, our internal notifications about applications, and the account and security emails described in Section 3.12. It receives the recipient’s email address and the content of each email so that it can deliver the message. It keeps a record of each message it handles, such as the recipient’s address, the time and whether the message was delivered, for a limited period set by its service. It also keeps suppression lists of addresses to which it will not deliver our emails: an address that permanently refused one of our emails, with the reason given, and an address from which one of our emails was reported as spam, with the date. We use these lists only to avoid sending email that cannot be delivered or is not wanted.
3. Our business email hosting provider. Hosts the mecavoy.com mailboxes that receive your messages to us and our internal notifications about applications.
4. Our video-conferencing provider. Carries the verification calls described in Section 3.4, including their audio and video. We do not record the calls unless you agree or the law requires it (see Section 3.4).
5. Our operations mailbox provider. Hosts, under its standard terms of service, the operations mailbox that receives the security alerts described in Section 2.4(d).

When you choose a password for an Advisor Account, we also use the Pwned Passwords service of Have I Been Pwned as described in Section 3.11(f). It receives only the first five characters of a hash of the password, which does not identify you, and no other information about you.

The Mecavoy Service may use other service providers. Before we move any information to it, we will name them in the emails described in Sections 2.7 and 3.14.

4.3 Other disclosures

We may also disclose personal information:

1. to issuing bodies, public registers and references you have given us, limited to what is necessary to verify your application (for example, your name and a registration number), and to the U.S. government services we use to search sanctions lists, limited to your name and country and, for the Registered Advisor track, the name of your business;
2. to our professional advisers, such as lawyers, accountants and insurers, where necessary and subject to duties of confidentiality;
3. where required by law, regulation, legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud; and
4. in connection with a merger, acquisition, financing, reorganization or sale of all or part of Mecavoy’s business or assets. If this occurs, we will notify you before your personal information becomes subject to a different privacy policy.

5. Cookies, Browser Storage and Tracking

5.1 Cookies

The public pages of the Site set no cookies. The Site sets the following cookies only if you create or sign in to an Advisor Account, and only on requests to our advisor account service (the path /api/advisor):

1. __Secure-mv_signup. Links your browser to the sign-up you started, so that you can enter your verification code. It lasts one hour, or until you confirm your email address.
2. __Secure-mv_advisor. Keeps you signed in to your Advisor Account. The session it holds ends when you sign out, after 60 minutes without activity, or 12 hours after you sign in, whichever comes first. It is a session cookie: signing out removes it, and your browser deletes it when you close the browser. If your browser is set to restore your previous session when it reopens, it may keep the cookie, but the session it holds still ends as stated above.
3. __Secure-mv_mfa. Links your browser to the sign-in you started when two-step sign-in is on, so that you can enter your code. It lasts five minutes, or until you finish signing in.
4. __Secure-mv_device. Recognizes a browser you have signed in from before, so that we can email you about sign-ins from new browsers. It contains only a signed random identifier. It lasts 180 days from your last sign-in on that browser, and it is not removed when you sign out. When you delete your Advisor Account, it is removed from the browser you use to delete the account; on any other browser it no longer matches any account, and it expires as stated.

All four are first-party cookies that your browser sends only over encrypted connections and only with requests that come from the Site itself, that scripts on the page cannot read, and that contain only signed random or pseudonymous identifiers, with the times and technical values needed to check and use them. They are strictly necessary to provide the account you request (see Section 5.5), and we do not use them for analytics or advertising. The Site uses no analytics, advertising or social media tracking technologies, and loads no content from third-party servers; the typefaces are served from the Site itself.

5.2 Browser storage

The Site stores limited information in your browser, on your device, where a feature you use requires it:

1. Founding advisor application. The text answers you type into the application form, and the country, state, province or region you choose, saved in your browser’s local storage under a pseudonymous identifier of your Advisor Account, so that you can finish later on the same device. Other options you select, such as checkboxes, and uploaded files are not saved. This draft stays on your device and is not sent to us until you submit the application. It is deleted when you submit the application or choose “Clear saved progress” or “Start over”, or when you sign out or delete your Advisor Account. A saved draft that is more than 30 days old is deleted automatically the next time you open the home page, a Founding Advisor Program page or the application form. You can also delete it through your browser settings. If you use a shared device, we recommend clearing your saved progress when you finish.
2. Advisor Account sign-up. The country you choose when you create an Advisor Account, saved in your browser’s session storage so that the application form can fill it in. It is deleted when the application form reads it, when confirming your email address takes you anywhere other than the application form, when you sign out or delete your Advisor Account, or when you close the browser tab.

Files you upload with an application are sent directly from your browser to our storage provider, AWS, over an encrypted connection.

5.3 Staff administration console

The administration console used by authorized Mecavoy staff sets two strictly necessary cookies, which are never set for visitors. The session cookie, __Secure-mv_admin, is set when a staff member signs in. It is a session cookie: it is removed when the staff member signs out, and the browser deletes it when it closes unless the browser is set to restore its previous session. Whether or not the browser keeps the cookie, the session it holds ends after a period of inactivity, when the staff member signs out, or 8 hours after sign-in, whichever occurs first. While a staff member signs in, a second cookie, __Secure-mv_admin_mfa, links the browser to the two-step sign-in in progress; it lasts five minutes, or ten minutes while the staff member first sets up two-step sign-in, and is removed when the sign-in is complete. The console also remembers the selected view in session storage.

5.4 Global Privacy Control and Do Not Track

We do not sell or share personal information (see Section 4.1), and the Site does not track visitors over time or across third-party websites. We nonetheless treat a Global Privacy Control signal sent by your browser as a valid request to opt out of any sale or sharing of your personal information. Because we do not sell or share personal information, honoring that request does not change how the Site operates. We do not respond to a Do Not Track signal differently, because the Site does no tracking for that signal to stop. No third party collects personally identifiable information about your online activities over time and across different websites through the Site.

5.5 Why we do not ask for consent to cookies and browser storage

The Site uses no analytics, advertising or third-party cookies, and no other technology that tracks you. Each cookie and each item of browser storage described in Sections 5.1 to 5.3 is strictly necessary to provide a service that you have explicitly asked for, and is used only for that purpose, so the Site does not show a cookie banner or ask for your consent to them. In the European Economic Area, this is the exemption in Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) for storage that is strictly necessary to provide an information society service explicitly requested by the user, as explained in the Article 29 Working Party’s Opinion 04/2012 on Cookie Consent Exemption (WP194). In the United Kingdom, it is the exception in Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended by the Data (Use and Access) Act 2025, for storage that is strictly necessary to provide an information society service requested by the subscriber or user. In particular:

1. __Secure-mv_signup and the sign-up country. They connect the steps of an Advisor Account sign-up you started: the cookie ties your browser to the sign-up so that you can enter your code, and the country you chose is carried to the application form so that you do not have to enter it again. Neither lasts beyond the steps it serves, as described in Sections 5.1(a) and 5.2(b) (user input, WP194 section 3.1).
2. __Secure-mv_advisor. It is a session cookie that keeps you signed in to the Advisor Account you signed in to, for no longer than the session described in Section 5.1, and is used for nothing else (authentication, WP194 section 3.2).
3. __Secure-mv_mfa. It carries a sign-in you started, after your password is checked, to the step where you enter your two-step code, for at most five minutes (authentication and user input, WP194 sections 3.2 and 3.1).
4. __Secure-mv_device. It lets us detect a sign-in to your Advisor Account from a browser we have not seen before and warn you by email, a security feature of the account you asked for. It is set only for people who sign in to an Advisor Account, contains only a signed random identifier, and is used for nothing else (user-centric security, WP194 section 3.3).
5. The application draft. It keeps the answers you typed, on your own device, so that you can finish the application you started, and is deleted as described in Section 5.2(a) (user input, WP194 section 3.1).
6. The administration console. Its session cookie, __Secure-mv_admin, signs in authorized staff (authentication, WP194 section 3.2). Its two-step cookie, __Secure-mv_admin_mfa, carries a sign-in in progress, after the password is checked, to the step where the staff member enters a two-step code or first sets up two-step sign-in, for at most ten minutes (authentication and user input, WP194 sections 3.2 and 3.1). Its session storage entry remembers the view a staff member chose (user interface customization, WP194 section 3.6).

You can block or delete cookies and browser storage in your browser settings. If you block the cookies described in Section 5.1, you cannot create or sign in to an Advisor Account.

6. Retention

We keep personal information only for as long as necessary for the purposes described in this Policy. Retention periods for application and Advisor Account information are set out in Sections 3.8 and 3.13. For the mailing list and our logs:

1. Subscriber records. Until you unsubscribe or ask us to delete your information, and in any event no longer than Section 2.7 provides.
2. After you unsubscribe. We delete your consent record, the record described in Section 2.1(c) and the information described in Sections 2.2 and 2.3, except that we keep your email address, your subscription status, the dates on which you subscribed and unsubscribed, and any record that an email to you could not be delivered, on a suppression list so that we do not contact you again, except as described below. If you subscribed while Version 1 of the Offer Terms was published, we keep only your email address on the suppression list, as those terms provide, and delete everything else. We also use the email address on the suppression list to honor the Offer Terms: unsubscribing does not end the Free Year of Mecavoy Plus reserved for that address, and if you open a Mecavoy account with it, the Free Year applies as those terms provide. We use the address for that purpose only until the Offer lapses for that address. If an address on the suppression list is entered in the signup form again, we do not add it back to the mailing list. We send one email to that address asking whether it should be added back, and no more than one such email to the same address in any 24 hours, unless the link in the previous one was used. The signup form adds the address back only if the link in that email is used within 48 hours; the new subscription is then recorded as described in Sections 2.1 to 2.3 and is governed by the current Offer Terms and this Policy (see Section 11.2). Until then the suppression record does not change, whichever version of the Offer Terms you subscribed under. If you ask us, from that address, to stop sending these emails, we stop, and we keep a record of your request, identified by a pseudonymous identifier derived from the address rather than by the address itself, until you ask us to add you back or to delete your information. We keep a request to rejoin, meaning the address and the information described in Sections 2.1(b), 2.1(c) and 2.2 that were submitted with it, separately from the suppression record, and we delete it automatically 48 hours after it is made; the deletion can take a few more days to complete. We keep the suppression record for as long as we operate the mailing list, subject to Section 2.7. Our email delivery provider also keeps its own suppression lists, as described in Section 4.2(b).
3. Signups that are not confirmed. A signup made from the publication of Version 2.5 of this Policy becomes a subscription only when the link in our confirmation email is used. Until then it is not on the mailing list, receives no emails from us other than the confirmation emails described in Section 2.1, and does not reserve a Free Year under the Offer Terms. We delete it automatically 7 days after it is made or, if the signup form is submitted again for the same address before then and we send another confirmation email in response, 7 days after the latest such submission, unless it is confirmed first; the deletion can take a few more days to complete. Under Version 1 of this Policy, a signup also became a subscription only when the confirmation link in our confirmation email was clicked, until we removed that confirmation step from the signup process. A signup from that time that was never confirmed is not on the mailing list, receives no emails from us and does not reserve a Free Year under the Offer Terms. We delete these records, and in any event no later than 12 months after each record was created.
4. Web and storage access logs. 90 days.
5. Application logs. Up to 90 days.
6. Correspondence. Emails you send us are kept for as long as reasonably necessary to respond to you and to keep a record of any request you make.
7. Backups. Deleted or changed database records may remain in encrypted backups for up to 35 days before they are permanently overwritten. Changes to subscriber records, requests to rejoin, applications and the records we keep to send account emails, which may include a record as it was before the change, also remain for up to 24 hours in the encrypted change records that our systems read to send emails.
8. Audit logs. Up to 365 days. A deleted log file may remain in the storage version history for up to 30 days before it is permanently removed.
9. Security findings. Up to 90 days after the finding was last updated.
10. Security alerts. The alerts emailed to our staff as described in Section 2.4(d) are deleted from the operations mailbox that receives them within 90 days after they are sent.

7. Security

We encrypt personal information in transit between your browser and our systems and between our systems and our service providers. The emails we send are encrypted in transit whenever the receiving mail server supports it. The databases, document storage and log storage that we operate encrypt personal information at rest. Application documents are encrypted with a key that we control in AWS Key Management Service, which only the systems and staff that need the documents can use; documents uploaded before we introduced that key remain encrypted by the storage service until they are deleted. The link in the email that asks you to confirm a new signup works only once, and we store only a one-way hash of it. Access to subscriber and application records is limited to authorized Mecavoy staff, who review them through a password-protected administration console over an encrypted connection. The underlying databases and document storage are not publicly accessible, and our email sending key is held in a managed secret store.

Advisor Account passwords are stored only as salted, one-way hashes computed with the scrypt algorithm; we refuse a new password that we find in known data breaches or in a list of common passwords; we limit repeated sign-in, verification, password reset and two-step sign-in attempts; signed-in sessions expire after inactivity; you may turn on two-step sign-in with an authenticator app, whose secret we store encrypted; and we email you when your password changes, when your account is signed in to from a new browser and when two-step sign-in is turned on or off.

No method of transmission or storage is completely secure. If a security incident affects your personal information, we will notify you, and any authority we are required to notify, as required by applicable law.

8. International Users

8.1 Where we process personal information

Mecavoy is based in the United States. We collect personal information directly from you through the Site and store and process it in the United States. Section 3.4 describes the information we obtain from other sources when we verify an application. Our service providers may also process personal information in other countries in which they operate. The data protection laws of the United States and of those countries may differ from those of your country.

8.2 Safeguards

Except for our operations mailbox provider (Section 4.2(e)), our service providers process personal information on our behalf under written contracts that require them to protect it and to use it only on our instructions. Where the law of your country requires it for information they receive from us, those contracts include safeguards such as the European Union’s standard contractual clauses. You may ask for a copy of these safeguards by emailing privacy@mecavoy.com; we may remove commercial terms from the copy.

8.3 Access by authorities

Personal information held in the United States may be accessible to U.S. courts, law enforcement agencies and national security authorities under U.S. law.

8.4 Who may take part

The Free Year of Mecavoy Plus is available only to residents of the United States, as set out in the Offer Terms. Anyone who is 18 years of age or older may subscribe to the mailing list, wherever they live, except that we do not accept a signup, or a request to rejoin the mailing list, when our content delivery network places the request, from its IP address, in Cuba, Iran, North Korea, Syria, Russia, Belarus, mainland China (not including Hong Kong, Macao or Taiwan) or the Crimea region of Ukraine, including the city of Sevastopol. We have chosen not to offer the mailing list or the Offer there. Independent Agents may apply to the Program from the countries listed on the application form, and the Registered Advisor track is open only to individuals who reside in the United States, as set out in Section 3 of the Program Terms. Advisor Accounts are available only to people who live in a country where the Program is open, as described in Section 3.10. Section 9 describes your rights, including additional rights for individuals in the European Economic Area, the United Kingdom and Switzerland (Section 9.3) and in other countries (Section 9.5).

8.5 Language

This Policy and our communications are in English. If we provide a translation, the English version controls.

9. Your Rights and Choices

9.1 Your choices

You may unsubscribe from the mailing list at any time using the link in any email we send, or by replying to any email and asking to be removed. If you do not want to confirm a signup, you need do nothing: it is deleted as described in Section 6(c). You may stop receiving advisor news at any time in the same way or by emailing support@mecavoy.com or privacy@mecavoy.com.

In the Advisor Console you can see the status of your application, change your name and password, turn two-step sign-in on or off, see the browsers signed in to your account and its recent security events, withdraw your application, sign out of all devices and delete your Advisor Account. If you cannot sign in, email privacy@mecavoy.com from the address of your Advisor Account to get a copy of your information, correct your email address, or delete your account; we check that the request comes from that address first.

9.2 Rights available to everyone

Wherever you live, you may ask us to:

1. confirm whether we hold personal information about you and give you access to it;
2. correct personal information that is inaccurate or incomplete;
3. delete your personal information, except the suppression record described in Section 6(b), the records described in Section 3.13(e) and (h) when an Advisor Account is deleted, information we are required by law to keep and information we need to establish, exercise or defend legal claims. Information about you in the logs, security findings and security alerts described in Section 2.4, and in the backups described in Section 6, is not removed early; it is deleted when the periods stated in Section 6 end;
4. provide your personal information in a portable, machine-readable format;
5. stop processing your personal information on the basis of our legitimate interests (the right to object); and
6. withdraw any consent you have given, which for the mailing list you may do by unsubscribing.

If, at your request, we also delete your email address from the suppression list described in Section 6(b), we will no longer hold a record that the address was subscribed, and the Free Year of Mecavoy Plus reserved for it can no longer be applied under the Offer Terms. We will tell you this before we delete it.

These rights are subject to the limits and exceptions set by applicable law. If we cannot fulfill a request in full, we will tell you why. We do not charge for these requests, and we will not treat you differently because you make one.

9.3 Individuals in the European Economic Area, the United Kingdom and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland:

1. Mecavoy LC, identified in Section 1.1, is the controller of your personal information, and Sections 2.6 and 3.6 set out our legal bases for using it;
2. you may also ask us to restrict our processing of your personal information;
3. you have the right to lodge a complaint with a data protection authority: in the European Economic Area, the authority in the country where you live or work or where the matter arose; in the United Kingdom, the Information Commissioner’s Office; and in Switzerland, the Federal Data Protection and Information Commissioner; and
4. we do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

You may also complain to us first, as described in Section 9.6. Section 5.5 explains why the Site does not ask for your consent to the cookies and browser storage it uses.

9.4 United States residents

Depending on the state in which you live, you may have rights under state privacy law, including rights to know, access, correct, delete and obtain a portable copy of your personal information, and to opt out of its sale, of targeted advertising and of profiling. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. For that reason we do not offer a “Do Not Sell or Share My Personal Information” link. If that changes, we will update this Policy and provide any opt-out required by law before the change takes effect. We treat a Global Privacy Control signal as described in Section 5.4.

In the preceding 12 months we have collected the following categories of personal information, from the sources and for the purposes described in Sections 2 and 3: identifiers (such as name, email address, phone number, IP address and hashed IP values); characteristics of protected classifications under California or federal law, limited to your confirmation that you are 18 years of age or older (or, for the Program, the age of majority where you live); from the date Advisor Accounts became available, account credentials (the email address and password of your Advisor Account, which California law treats as sensitive personal information and which we use only as described in Section 3.12); customer records information (such as name, phone number and any insurance information in documents you upload); commercial information (the Free Year reserved for your email address); professional or employment-related information (such as experience, specialties, business details and registrations, and the results of sanctions screening); audio, electronic, visual or similar information (your headshot); and internet or other electronic network activity information (such as user agent, source page, the country from which an application was submitted or a sign-in from a new browser was made, the location checked when you sign up for the mailing list or create an Advisor Account, which we do not keep, sign-in and security records, and log data). We collect these categories from you, automatically from your browser or device and, for applications, from the sources described in Section 3.4. We disclose each of these categories for business purposes to the service providers described in Section 4.2. We disclose identifiers and professional or employment-related information to the issuing bodies, public registers, references and U.S. government services described in Section 4.3(a), limited as described there, and we may disclose personal information as Section 4.3 otherwise describes. We keep these categories for the periods described in Sections 2.7, 3.8, 3.13, 3.14 and 6. We do not sell or share personal information, including that of consumers under 16 years of age. We use and disclose sensitive personal information only for the purposes permitted by section 7027(m) of the California Consumer Privacy Act regulations, and we do not use it to infer characteristics about you.

If you live in Nevada, you may send a verified request directing us not to sell your covered information, as Nevada law defines it, to privacy@mecavoy.com. We do not sell covered information.

9.5 Individuals in other countries

Wherever you live, you may exercise the rights described in Section 9.2. Depending on where you live, the law of your country may give you further rights, including the right to complain to your local data protection authority. If you live in Canada, you may complain to the Office of the Privacy Commissioner of Canada, and you may contact the person accountable for our compliance with Canadian privacy law at privacy@mecavoy.com.

9.6 How to make a request

Email privacy@mecavoy.com. To protect your information, we may ask you to confirm the request from the email address associated with it before we act on it. You may make a request through an authorized agent, in which case we will ask the agent for proof of their authority and may ask you to confirm the request directly.

We respond to requests within 30 days after we receive them or, if the European Union’s or the United Kingdom’s General Data Protection Regulation applies to your request and one month is the shorter period, within one month. Where reasonably necessary, taking into account the complexity and number of requests, we may extend that period once by up to a further 30 days, and if we do we will tell you why before the first period ends. If we decline a request, we will explain why, and you may appeal the decision by replying to our response; we will respond to an appeal within the period required by applicable law. If you are not satisfied with the outcome, you may contact the attorney general of your state or, if you live in California, the California Privacy Protection Agency.

Complaints. You may complain to us about how we handle your personal information by emailing privacy@mecavoy.com. We acknowledge a complaint within 30 days after we receive it and tell you the outcome without undue delay. Complaining to us does not affect your right to complain to a data protection authority or other regulator.

10. Children

You must be 18 years of age or older to subscribe to the mailing list, and the signup form asks you to confirm it. Until Version 2.5 of this Policy, anyone 13 years of age or older could subscribe; the age requirement applies to signups made from Version 2.5. If we learn that a person under 18 has signed up since then, we may remove the address from the mailing list. The Site is intended for adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must be at least 18 years of age to claim the Free Year under the Offer Terms. To apply to the Program, you must be at least 18 years of age and, if the age of majority where you live is higher, have reached that age. The same requirement applies to creating an Advisor Account. If you believe that a child under 13 has provided personal information to us, contact privacy@mecavoy.com and we will delete it.

11. Changes to This Policy

11.1 How we make changes

We will post any change to this Policy on this page with a new version number and effective date. If a change materially affects how we use personal information we already hold about you, we will email you at least 30 days before the change takes effect, and where the law requires your consent we will ask for it. Previous versions of this Policy are available on request from privacy@mecavoy.com.

11.2 Subscribers under Version 1

This Section 11.2 applies to you if you subscribed to the mailing list while Version 1 of this Policy was the version published on the Site, and only for as long as that subscription continues. If it ends and you subscribe again, the version of this Policy published when you subscribe again applies to the new subscription. Any change made by Version 2 of this Policy, or by a later version, that reduces a commitment made to you in Version 1 takes effect for you 30 days after the date on which we email you notice of that change. Until then, the Version 1 commitment continues to apply to you. This Section 11.2 does not reduce any right that the Offer Terms give you, and the Free Year of Mecavoy Plus reserved for your email address remains reserved for it after you unsubscribe, as the Offer Terms provide (see Section 6(b)). The changes to which this Section 11.2 applies include the following:

1. Deletion requests (Section 9.2(c)). Version 1 stated that, on request, we delete the information we hold about you except your email address, which stays on the suppression list. This Policy also allows us to keep information that we are required by law to keep or that we need to establish, exercise or defend legal claims, and states that information about you in our logs, security findings, security alerts and backups is not removed early but is deleted when the periods stated in Section 6 end.
2. Response times (Section 9.6). Version 1 stated that we answer requests within 30 days, or within 45 days in California, where the period may be extended once. This Policy states that we respond within 30 days and may extend that period once by up to a further 30 days.
3. Do Not Track and Global Privacy Control (Section 5.4). Version 1 stated that we treat a Do Not Track or Global Privacy Control signal as an objection to any processing that you are entitled to object to. This Policy treats a Global Privacy Control signal as a request to opt out of any sale or sharing, and does not respond to a Do Not Track signal differently.
4. Security incidents (Section 7). Version 1 stated that, if a breach affects your information and creates a real risk to you, we will tell you and the relevant regulator without unreasonable delay. This Policy states that we will notify you, and any authority we are required to notify, as required by applicable law.
5. Encryption (Section 7). Version 1 stated that information is encrypted in transit and at rest. This Policy states that information is encrypted in transit between your browser and our systems and between our systems and our service providers, that the emails we send are encrypted in transit whenever the receiving mail server supports it, and that information is encrypted at rest in the databases, document storage and log storage that we operate.
6. Disclosures (Section 4). Version 1 named Amazon Web Services and Mailgun as our only service providers, and otherwise described disclosures only to our accountants, lawyers or insurers, to authorities that the law obliges us to inform, and in connection with a sale of Mecavoy or its assets. This Policy adds our business email hosting provider and our operations mailbox provider, and disclosures in response to legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud.
7. How addresses are added to the mailing list (Section 2.5). Version 1 stated that we do not add addresses that were not given to us directly by the person to whom they belong. This Policy states that we add addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.
8. Logs and backups (Sections 2.4 and 6). Version 1 did not describe application logs or backups. This Policy states that application logs, which may include IP addresses, are kept for up to 90 days, that deleted or changed records may remain in encrypted backups for up to 35 days, and that changes to records may remain for up to 24 hours in the change records our systems read to send emails.
9. Browser storage (Section 5). Version 1 stated that the Site sets no cookies at all. The public pages of the Site still set no cookies, but the Site stores limited information in your browser as described in Section 5.2, and the staff administration console sets cookies for authorized staff only.
10. Our email delivery provider’s suppression lists (Sections 4.2(b) and 6(b)). Version 1 stated that, after you unsubscribe, everything is deleted except your email address. This Policy also states that our email delivery provider keeps, on its own suppression lists, the reason an email to your address was permanently refused, or the date on which one of our emails was reported as spam from it.
11. Moving the mailing list (Section 2.7). Version 1 stated that a fuller policy would take over when the product opens, and that we would email you before that happens. This Policy states that we will move the mailing list to the Mecavoy Service, what moves and what does not, and that, from the move, the privacy policy of the Mecavoy Service applies to the information moved. It also states that we will email you at least 30 days before the move.

This Section 11.2 does not apply to the cookies described in Section 5.1, which are set only if you choose to create or sign in to an Advisor Account.

11.3 Applicants before Version 2.3

This Section 11.3 applies to you if you applied to the Program before Version 2.3 of this Policy was published. The changes that Version 2.3 makes to how we use information about applicants, including the sanctions screening described in Section 3.4, take effect for your application 30 days after the date on which we email you notice of them. Until then, we use the information in your application as Version 2.2 describes, and we do not check it against the sanctions lists.

12. Contact Us

Mecavoy LC, 5830 E 2nd St, Ste 7000 #38404, Casper, WY 82609, United States.

Privacy questions and requests: privacy@mecavoy.com. All other questions: support@mecavoy.com.

If you have a disability and need this Policy, the Offer Terms or the Program Terms in another format, email privacy@mecavoy.com and we will provide it in a format you can use.

Version History

This version history is provided for information and does not form part of this Policy.

Version 2.5, September 29, 2026. This version describes the confirmation step for new signups to the mailing list, the age requirement and the Offer Terms checkbox on the signup form, the location check made when you sign up, and how we will move the mailing list and Advisor Accounts to the Mecavoy Service. It also completes or corrects the description of our records, logs, service providers, retention periods and security. The changes are as follows:

1. The Summary adds the record of your acceptance of the Offer Terms to what we hold for the mailing list, adds items on the age requirement and the confirmation step, and on moving information to the Mecavoy Service, and no longer has a separate item on the former two-step signup, which Section 6(c) still describes;
2. Section 1.2 states that the Mecavoy Service is scheduled to open to founding advisors for early access in December 2026 and to travelers across the United States in January 2027, and refers to Sections 2.7 and 3.14 for how information will move to it;
3. Section 2.1 states that a new signup becomes a subscription, and the Free Year is reserved, only when the link in our confirmation email is used, and that we send no more than three confirmation emails to the same address in any 24 hours. Section 2.1(b) states how consent is confirmed, and new Section 2.1(c) describes the required checkbox in which you confirm that you are 18 or older and agree to the Offer Terms, and the record we keep of it;
4. Section 2.2 adds the location check made when you sign up or ask to rejoin, which we do not store, and states how we use the time at which the signup page was loaded, and Section 2.3 adds the information we generate for the confirmation step;
5. Section 2.4(a) states that access logs include the parameters of the link requested, which for an unsubscribe link, a link to confirm a signup or a link to claim the Free Year include your email address in encoded form. The logs already held these parameters; the description is now complete. Section 2.4(b) adds confirmations and declined signups to the events logged, and Section 2.4(d) states that security alerts are emailed to an operations mailbox used only by authorized Mecavoy staff, in place of a mecavoy.com mailbox;
6. Section 2.5 adds date of birth to the information we do not collect for the mailing list;
7. Section 2.6 states that we send the emails you agreed to receive, and apply the Free Year, once you have confirmed your email address; adds checking that the domain of an address can receive email, the confirmation emails, and offering the mailing list only to adults and not in the places listed in Section 8.4; uses the source page only as part of the record of how you gave your consent, in place of using it to understand which pages lead to signups; and states that the two checkboxes on the signup form are required;
8. new Section 2.7 describes how we will move the mailing list to the Mecavoy Service: at least 30 days’ notice by email, what moves and what does not, and the deletion of our records within 30 days after the move;
9. Section 3.2(e) states that we keep the wording of each confirmation given on the application form, Section 3.3 adds the identifier your browser gives a submission, Section 3.5 adds the flags our systems add to help reviewers, and Section 3.6(c) adds applying the provisions of the Program Terms that depend on where you live;
10. Section 3.8 states that a deleted document may remain in the storage version history for up to 7 days, in place of up to 30 days;
11. Section 3.10 names the places in which we do not open an Advisor Account when our content delivery network places the sign-up request there, which now include Syria and mainland China, and states that passwords are hashed with the scrypt algorithm. Sections 3.10 and 3.11(b) add the record of the box checked when an Advisor Account is created, and Section 3.11(a) states that the password hash kept during sign-up is a salted, one-way hash that is itself encrypted, in place of calling it an encrypted hash;
12. Section 3.14 is renamed “Moving your Advisor Account to the Mecavoy Service”. It states that we intend to move Advisor Accounts before the Mecavoy Service opens to founding advisors for early access, scheduled for December 2026, in place of when it launches; that we move a one-way hash of your password and never the password itself; that the documents uploaded with an application move with it; that we will not move the secret or the recovery codes for two-step sign-in, which is set up again on the Mecavoy Service; that a record limiting when an address may apply again may move; and that the notice of the move will name the service providers that will hold the information moved. Section 3.13(e) refers to Section 3.14 for the move, in place of referring to launch;
13. Section 4.2 names the AWS services we use, describes the records and suppression lists kept by our email delivery provider, adds our operations mailbox provider, which holds security alerts under its standard terms of service, in place of our business email hosting provider for security alerts, describes the Pwned Passwords service, and states that we will name the service providers of the Mecavoy Service before we move information to it;
14. Section 6(a) and (b) refer to Section 2.7 for the move to the Mecavoy Service. Section 6(b) states that the record described in Section 2.1(c) is deleted when you unsubscribe, like the consent record, that a request to rejoin includes that record, and that our email delivery provider keeps its own suppression lists. Section 6(c) states how long signups that are not confirmed are kept, Section 6(g) states that changes to records may remain for up to 24 hours in the change records our systems read to send emails, and Section 6(j) states that security alerts are deleted from the operations mailbox within 90 days after they are sent, in place of stating that they are deleted automatically 90 days after they are sent;
15. Section 7 states that application documents are encrypted with a key that we control, that the link in the email confirming a new signup works only once and is stored only as a hash, and that passwords are hashed with the scrypt algorithm;
16. Section 8.2 states that our operations mailbox provider is not among the service providers that process personal information under written contracts, and Section 8.4 states that you must be 18 or older to subscribe to the mailing list, and the places from which we do not accept a signup or a request to rejoin;
17. Section 9.1 states that a signup you do not confirm is deleted, and Section 9.4 adds your confirmation that you are 18 or older and the location checked at sign-up to the categories of information collected;
18. Section 10 states that you must be 18 years of age or older to subscribe to the mailing list, in place of 13, for signups made from this version; and
19. Section 11.2 applies to changes made by any version after Version 1, states that a new subscription is governed by the version of this Policy published when it is made, adds our operations mailbox provider to Section 11.2(f) and the change records to Section 11.2(h), and adds Section 11.2(j) on our email delivery provider’s suppression lists and Section 11.2(k) on moving the mailing list.

The changes to how you sign up for the mailing list (Sections 2.1, 2.2, 2.6, 8.4 and 10) apply to signups made from the publication of this version, and do not change how we use the information we already hold about existing subscribers. Section 2.7 describes a later move of that information, which we will announce to subscribers by email at least 30 days in advance. Section 11.2 sets out when the changes that reduce a commitment made in Version 1 take effect for subscribers under Version 1. The other changes describe our existing practices more completely or more accurately.

Version 2.4, September 28, 2026. This Policy now also covers Advisor Accounts, which are required to apply to the Program. The principal changes are as follows:

1. Section 1.2 adds Advisor Accounts to the scope of this Policy, Section 1.3 defines Advisor Accounts, the Advisor Console and the Mecavoy Service, Section 3 is renamed “Founding Advisor Applications and Advisor Accounts”, and the Summary adds Advisor Accounts to its first item and adds an item on Advisor Accounts;
2. Section 2.4(b) adds Advisor Accounts, and the approximate country recorded with a sign-in from a new browser, to the application logs, new Section 2.4(c) describes the audit log of changes to our systems, new Section 2.4(d) describes the automated security monitoring of our systems, the malware scanning of files uploaded through the application form and the security alerts that are emailed to our staff, and Section 2.6 states that Section 2, together with Sections 4, 6, 8 and 9, is our notice at collection for subscribers;
3. Section 3.1 extends Section 3 to Advisor Accounts and gives the new addresses of the sign-up page and the application form, Section 3.2 states that the email address of an application made through an Advisor Account is the email address of that account, and Section 3.3 adds the account identifier to the information collected with an application. Section 3.1 also states that Section 3, together with Sections 4, 6, 8 and 9 (in Version 2.3, Sections 4.1, 8 and 9), is our notice at collection for holders of Advisor Accounts and for applicants;
4. Section 3.5 adds the Advisor Account linked to an application and any later version of the Program Terms that the account accepted, the date from which an applicant may apply again after a decline, and the summary of a declined application kept with a later application, and Section 3.7 describes the internal notice sent when an application is withdrawn or deleted, and how long we keep that notice;
5. Sections 3.8 and 3.9 describe withdrawing an application in the Advisor Console and deleting it with an Advisor Account, state that a withdrawn application is not carried into a later one and that the documents of a declined application are deleted when a new application replaces it, and refer to the rules on applying again in the Program Terms. Section 3.8(f) adds the deletion of an Advisor Account to the cases in which we keep the screening records and identifying information after a confirmed sanctions match. It also states that the documents, the rest of the application and our internal notification of it are deleted as the other items provide, including when the application is withdrawn in the Advisor Console or deleted with an Advisor Account, and that after a withdrawal in the Advisor Console what we keep stays linked to the Advisor Account until the account is deleted or the applicant asks us to delete the application. Section 3.8(e) states that the automatic deletion of files never submitted with a completed application can take a few more days to complete. Section 3.9 states that an application may be withdrawn at any time before the Advisor Agreement is signed, as Section 15 of the Program Terms provides, and that Section 16.4 of the Program Terms applies after that;
6. new Sections 3.10 to 3.14 describe who may open an Advisor Account, the information we collect and generate for it, including verification codes, two-step sign-in, device records and the approximate location used for security emails, how we use that information, how long we keep it, and what happens to Advisor Accounts when the Mecavoy Service launches. Section 3.10 names the places in which we do not open an Advisor Account when our content delivery network places the sign-up request there, and states that the network cannot tell whether a request comes from the so-called Donetsk People’s Republic or Luhansk People’s Republic regions;
7. Section 4.2 adds Advisor Account records and the account and security emails to what our service providers handle, adds the security monitoring and security alerts described in Section 2.4(d) to what AWS provides and the security alerts to what our business email hosting provider hosts, and adds our video-conferencing provider, which carries the verification calls described in Section 3.4;
8. Section 5.1 is renamed “Cookies” and lists the four strictly necessary cookies set only for Advisor Accounts, Section 5.2 describes how the application draft is tied to an Advisor Account and the country kept in the browser during sign-up, Section 5.3 describes the two cookies set by the staff administration console and states that its session cookie is deleted when the browser closes, and new Section 5.5 explains why the Site does not ask for consent to cookies and browser storage. Section 5.2 no longer describes an entry in session storage recording that the opening animation on the home page has played, because the Site no longer stores one;
9. Section 6 refers to the retention periods in Section 3.13 and adds the retention of audit logs, security findings and security alerts, Section 7 describes how Advisor Accounts are secured, and Section 8.4 states where Advisor Accounts are available;
10. Section 7 states which transmissions are encrypted: those between your browser and our systems and between our systems and our service providers, and the emails we send whenever the receiving mail server supports it;
11. Section 9.1 describes what you can do in the Advisor Console and how to make a request if you cannot sign in, and adds privacy@mecavoy.com as an address to which you may write to stop advisor news, Section 9.2(c) adds the records kept when an Advisor Account is deleted to the exceptions to deletion and states that information about you in our logs, security findings, security alerts and backups is deleted when the periods stated in Section 6 end, and Section 9.3 refers to Section 5.5;
12. Section 9.4 adds account credentials and sign-in and security records to the categories of information collected, identifies the sources of those categories and the recipients to whom each is disclosed, states that we do not sell or share the personal information of consumers under 16 years of age and that we use sensitive personal information only for the purposes permitted by the California Consumer Privacy Act regulations, and states where residents of Nevada may send a request not to sell their covered information;
13. Section 9.6 provides that, where the European Union’s or the United Kingdom’s General Data Protection Regulation applies to a request and one month is the shorter period, we respond within one month, and that we may extend the period only where reasonably necessary, taking into account the complexity and number of requests, and will tell you why before the first period ends;
14. Section 10 applies the age requirement for applying to the Program to Advisor Accounts;
15. Section 11.2(i) states that the staff administration console sets cookies, rather than one cookie, for authorized staff only, Section 11.2 states that it does not apply to the cookies described in Section 5.1, which are set only if you choose to create or sign in to an Advisor Account, and Sections 11.2(a) and 11.2(e) are updated to match Sections 9.2(c) and 7; and
16. Section 12 states how a person with a disability may obtain this Policy, the Offer Terms or the Program Terms in another format.

These changes do not change how we use information about subscribers. Sections 7 and 9.2(c) are revised, and Section 11.2 sets out when those revisions take effect for subscribers under Version 1. No other provision of Version 2.3 is changed.

Version 2.3, September 26, 2026. Section 3 now reflects Version 1.1 of the Program Terms, under which Independent Agents may apply from the countries listed on the application form and the Registered Advisor track remains open only to individuals who reside in the United States. The principal changes are as follows:

1. Section 3.1 states who may apply on each track, and the Summary is updated to match;
2. Sections 3.2 and 3.3 describe the country and region we collect, the confirmation of the age and sanctions requirements, and the country (and, for a check only, the region) from which an application is submitted, and state that we do not ask for identity document numbers, tax identification numbers or payment details when you apply;
3. Section 3.4 describes the screening of applicants, and on the Registered Advisor track their businesses, against U.S. government restricted-party lists. It states that we do not search public records about applicants who live outside the United States, other than to confirm a credential they have submitted and to check those lists, or obtain criminal or court records about them, and that we do not record verification calls or keep copies of identity documents;
4. Section 3.5 adds the results of that screening to the information we generate, Section 3.6 sets out our legal bases for using application information, and Section 3.8 describes how long sanctions screening records are kept;
5. Section 4.3 adds the U.S. government services we use to search sanctions lists;
6. Section 5.2 states that a saved application draft also keeps the country, state, province or region the applicant chooses;
7. Section 8 states that we collect personal information directly from the people it is about and store it in the United States, describes the safeguards in our contracts with service providers and access by U.S. authorities, and states that this Policy is in English;
8. Section 9.3 now also covers Switzerland, Section 9.4 adds sanctions screening results and the country from which an application was submitted to the categories of information collected, Section 9.5 is added for individuals in other countries, and Section 9.6 describes how to complain to us;
9. Section 10 states the age requirement for applying to the Program; and
10. Section 11.3 is added. It states that, for people who applied before this version was published, the changes to how we use information about applicants take effect 30 days after we email them notice of the changes.

These changes do not change how we use information about subscribers.

Version 2.2, September 26, 2026. Sections 2.1, 2.3, 2.6 and 6(b) now describe how an address that has unsubscribed can rejoin the mailing list: if the address is entered in the signup form again, we email it one link to confirm, send no more than one such email in any 24 hours unless the link in the previous one was used, and add the address back only if the link is used within 48 hours. The suppression record, including the one kept for subscribers under Version 1, does not change unless the link is used. Section 6(b) also states how long a request to rejoin is kept, and how to stop these emails. In the Summary, the item on unconfirmed signups now says that it concerns the former two-step signup. No other provision of Version 2.1 is changed.

Version 2.1, September 26, 2026. Section 10 now states that anyone 13 years of age or older may subscribe to the mailing list, in place of the statement that the Site is intended for adults. The age requirements for claiming the Free Year and for applying to the Program are unchanged. No other provision of Version 2 is changed.

Version 2, September 25, 2026. Version 2 replaces Version 1, which covered the mailing list only. The changes are as follows:

1. Section 3 is added to cover applications to the Program. The Program is open only to individuals who reside in the United States and to businesses organized or registered there. Section 3.4 states that we do not obtain consumer reports from consumer reporting agencies, and that if we ourselves obtain public records about an applicant during verification, we will email the applicant a copy within seven days after we obtain them.
2. The description of how you subscribe is corrected, because subscribing no longer involves a separate confirmation step. Section 6(c) states that a signup that required a confirmation email and was never confirmed is not on the mailing list, receives no emails, does not reserve a Free Year and is deleted.
3. The description of the hashed value derived from your IP address is corrected.
4. Section 2.5 states that we add to the mailing list only addresses submitted through the signup form on the Site or at the request of the person to whom the address belongs.
5. Section 6 now describes the information kept after you unsubscribe, which includes your subscription status, the dates on which you subscribed and unsubscribed and any record of an undelivered email as well as your email address. If you subscribed while Version 1 of the Offer Terms was published, Section 6(b) provides that we keep only your email address, as those terms provide. Section 6(b) also states that unsubscribing does not end the Free Year reserved for your email address and that we use the address kept on the suppression list to apply it under the Offer Terms until the Offer lapses for that address, and Section 9.2 states that the Free Year can no longer be applied if we delete the address from the suppression list at your request. Sections 2.4 and 6 also describe application logs and the retention of application logs, correspondence and backups.
6. Section 5 now describes the browser storage used by the Site and the cookie used by the staff administration console. Version 1 stated that the Site sets no cookies at all.
7. Section 5.4 describes how we treat Global Privacy Control and Do Not Track signals. Version 1 stated that we treat either signal as an objection to any processing that you are entitled to object to. This Policy treats a Global Privacy Control signal as a valid request to opt out of any sale or sharing of personal information, and does not respond to a Do Not Track signal differently, because the Site does no tracking for that signal to stop.
8. Section 4.2 adds our business email hosting provider to the list of service providers, and Section 4.3 adds disclosures in response to legal process or an enforceable governmental request, or where reasonably necessary to protect the rights, property or safety of Mecavoy, our users or others, or to prevent fraud.
9. Section 7 states that personal information is encrypted at rest in the databases, document storage and log storage that we operate, and that we will notify you of a security incident as required by applicable law.
10. Section 9 extends the rights it describes to individuals wherever they live, adds rights for individuals in the European Economic Area and the United Kingdom, allows us to keep information that the law requires us to keep or that we need for legal claims when you ask us to delete your information, and describes authorized agents and appeals. Requests are answered within 30 days, which we may extend once by up to a further 30 days; Version 1 stated 30 days, or 45 days in California.
11. Section 11.2 is added. If you subscribed while Version 1 was published, a change made by Version 2 that reduces a commitment made to you in Version 1 takes effect for you 30 days after we email you notice of it, and until then the Version 1 commitment continues to apply. Section 11.2 describes those changes.

These changes describe our existing practices more accurately and add processing only for founding advisor applicants. They do not change the purposes for which we use the information we already hold about subscribers. Some of them reduce a commitment made in Version 1, and Section 11.2 sets out when those changes take effect for subscribers under Version 1.

Every earlier version of this Policy is published word for word at mecavoy.com/legal.