WINDUP MINDS

STAY FOREVER HOME

PRIVACY POLICY

Last Updated: March 24, 2025

Welcome to the Windup Minds websites https://www.windupminds.com/ and
https://stay-forever-home.com/ (the “Sites”) and our game, Stay Forever Home (the “Game” and
together with the Sites our “Services”). We respect your privacy and have composed this Privacy Policy
to help you understand how we process your Personal Data (defined below) and your choices about the
data we process.

This Privacy Policy explains what Personal Data (defined below) we collect in connection with the
Services, how we use and share that data, and your choices concerning our data practices. This policy
applies only to information we collect via the Services and in email, text, and other electronic
communications sent through or in connection with the Services.

This policy DOES NOT apply to information that you provide to or is collected by any third party, or which
is collected outside of the Services (see “Third-Party Information Collection”).

This Privacy Policy is incorporated into and forms part of our End User License Agreement.
Before using the Services or submitting any Personal Data to us, please review this Privacy Policy
carefully and contact us at the email address below if you have any questions.

By using the Services, you consent to the practices described in this Privacy Policy.

If you do not consent to this Privacy Policy, please do not access or otherwise use the Services.

1. DATA CONTROLLER

Windup Minds, Inc. (“Company,” “we,” “us,” or “our”) will be the entity responsible for your data. To ask
questions or comment about this privacy policy and our privacy practices, you can contact us at:

Email: privacy@windupminds.com

2. CHILDREN

Our Services are directed to a general audience, however, we are aware that children may be interested
in the Game. We use Meta Age Verification to verify the age of our users. Users under the age of 13 must
have a Meta account set up by their parents or legal guardians. Meta also provides parental supervision

tools for teens ages 13-17. Through its parental supervision system, Meta obtains parental or legal
guardian approval before children are able to download the Game. If we learn that we have collected or
otherwise processed the Personal Data of a minor without the requisite parental consent, we will delete
that information. If you have reason to believe that we have received or processed the Personal Data of a
child through the Game without the requisite verified parental consent, please contact us at
privacy@windupminds.com, and we will endeavor to delete that information from our databases. This is
in compliance with the Children’s Online Privacy Protection Act and Article 6(1)(c) of the GDPR.

3. PERSONAL DATA WE COLLECT

We collect information that alone or in combination with other information in our possession could be
used to identify you (“Personal Data”) as follows:

Personal Data You Provide. We collect Personal Data from you when you provide it to us directly. For
example when you fill out a form on the Sites, apply for a job with us, or contact us in regard to this
Privacy Policy, we will receive the information that you choose to include in your communication to us.
Additionally, when you sign up for our mailing list through the Sites, we will receive your email address.

Automatically Collected Information. When you visit, use, and interact with the
Sites or the Game, we may receive certain information about your visit, use, or interactions.

• For example, through the Sites we may collect your browser ID and information about
  the resources that you access and use on the Sites. We may receive any information that your
  browser automatically sends whenever you visit the Sites which may include your Internet
  Protocol address, browser type and settings, the date and time of your request, and how you
  interacted with the Sites. We also receive information about the device you use to access the
  Sites, your interaction with the videos on the site, and your video streaming preferences.
• Cookie Data: Please see the “Cookies” section below to learn more about how we use
  cookies.
• Location Data: We derive a rough estimate of your location from your IP address.
• Email Open/Click Data: We use pixels in our email campaigns that allow us to collect
  your email and IP address, as well as the date and time you open an email or click on any
  links in the email.
• Through the Game, we passively collect certain Personal Data as necessary for the Game
  to function properly, as well as other Personal Data that assists us in optimizing user experience.This Personal Data includes:

• Room and video data. Passthrough cameras collect room and video data. Oculus stores room data in the form of scanned meshes. This enables us to provide realistic navigation and interactions in mixed reality. The video feed from the passthrough cameras is stored locally on your device. This enables us to overlay virtual objects accurately in real time.
• Voice and audio inputs are collected for local keyword detection and analysis only. These inputs are not externally recorded or stored.
• Height detection. This information is session-specific and deleted after each session. We collect user height to tailor virtual pet interactions and accessibility to your specific height.
• Analytics. Our third-party analytics provider also collects gameplay metrics and user behavior data in the form of aggregate user interactions and events. This information helps us to measure things like player frustration and whether players are missing or not seeing important scripted events, or ignoring key objects needed for progression. We use this information to improve future game updates and inform future development.

Cookies: We use cookies to operate and administer our Sites, gather usage data on our Sites, and improve your experience on it. A “cookie” is a piece of information sent to your browser by a website you visit. Cookies can be stored on your computer for different periods of time. Some cookies expire after a certain amount of time, or upon logging out (session cookies), others survive after your browser is closed until a defined expiration date set in the cookie (as determined by the third party placing it) and help recognize your computer when you open your browser and browse the Internet again (persistent cookies). For more details on cookies, please visit All About Cookies.

If you are accessing the Sites from a jurisdiction that requires consent, our cookie pop-up will allow you to manage your cookie consent preferences. Additionally, most web browsers will enable you to manage and turn off cookies via your browser settings. You can do this by navigating to the “help” section on your browser toolbar. Please see the links below for guidance on how to modify your web browser’s settings on the most popular browsers:

• Internet Explorer
• Mozilla Firefox
• Google Chrome
• Apple Safari

Do Not Track Signals: Our Sites currently do not respond to “Do Not Track” (“DNT”) signals and operates as described in this Privacy Policy, whether or not a DNT signal is received. If we do respond to DNT signals in the future, we will update this Privacy Policy to describe how we do so.

Third-Party Information Collection Through the Services: As stated above, some features of the Sites and Game are served by third parties (“Third-Party Services”). When you use the Services, certain third

parties may use automatic information collection technologies to collect information about you or your
device. These third parties include Oculus, our security provider, user and parental consent providers,
analytics providers, cloud storage provider, video streaming provider, and email marketing providers. The
Personal Data that we receive from Third-Party Services is covered by this privacy policy.

Social Platforms: We also have accounts and servers on social media platforms like Instagram, Facebook,
X/Twitter, and Discord (“Social Platforms”). The Social Platforms are operated by the owners of the
relevant social media platforms, and the collection of information by third parties on the Social Platforms
is governed by the privacy policy of the applicable platform. When you interact with our Social Platforms,
we may also collect Personal Data that you elect to provide to us, such as your contact details.

4. OUR LEGAL BASES FOR PROCESSING YOUR INFORMATION

When we collect or otherwise process any of your Personal Data, we do so in reliance on the following
legal bases:

• Your consent. If you have provided us with your consent to process your information for
  a specific purpose, we will do so based on your consent. You may withdraw your consent at any
  time by following the instructions provided below in the “Your Rights and Choices” section
  below.
• Performance of a Contract with You. When the processing of your Personal Data is
  necessary in order for us to perform a contract with you or when you request that we process
  your information prior to entering into a contract with you, we will do so on this basis.
• Our Legitimate Interests. When we believe the processing of your Personal Data is
  reasonably necessary in order for us to achieve our legitimate interests in conducting and
  managing our business and our relationship with you, we will do so on this basis, including the
  legitimate interest we have in: 
  • personalizing, enhancing, modifying, or otherwise improving the Services and/or the
    communications that we provide to you;
  • retaining and engaging you and our other users;
  • detecting and preventing fraud and operating a safe and lawful business; and
  • improving the security and optimization of our network, sites, and Services.

  When we use your information for our legitimate interests, we take into account any potential
  impact that such use may have on you by balancing our legitimate interests against your
  interests, rights, and freedoms. We will not use your information if there is a less intrusive way
  for us to achieve our legitimate interests or if we believe your interests should override ours
  unless we have other grounds to do so (such as your consent or a legal obligation).

• Our Legal Obligations. When we believe that the processing of your information is necessary in order for us to comply with our legal obligations (such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved) we will do so on this basis.
• Vital Interests. When we believe that the processing of your information is necessary in order to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person, we will do so on this basis.

5. HOW WE USE PERSONAL DATA

We may use Personal Data for the following purposes:

• To provide, support, and maintain the Services;
• To provide you with customer support;
• To communicate about promotions, upcoming events, and other news about our games and services with your consent;
• To send administrative information to you, for example, information regarding the Services and changes to our terms, conditions, and policies;
• To optimize, develop, and improve our Services;
• To respond to you if you contact us;
• To fulfill any other purpose for which you provide it;
• To analyze how you interact with our Services
• To develop new products and services;
• To prevent fraud, criminal activity, or misuse of our Services, and to ensure the security of our IT systems, architecture, and networks;
• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.;
• For any reason that we described to you when collecting your Personal Data or for any reason for which you’ve provided us with your consent;
• To protect the rights, interests, and safety of us, you, and any third parties, and to exercise and defend our rights; and
• To create anonymous, de-identified, or aggregated datasets (“Aggregated Information”). Such datasets would not be “Personal Information” subject to this Privacy Policy. We may use anonymous, de-identified, or aggregated datasets for any purpose. For more information about Aggregation Information, see below.

The usage information we collect helps us to improve our Services and to deliver a better and more personalized experience by enabling us to:

• Recognize you when you use the Services.
• Estimate our audience size, demographics, and usage patterns.
• Comply with your consents.
• Understand how well the Services features are working and whether users are having issues.
• Identify and correct software defects.
• Prevent fraud and illegal behavior by detecting behavior patterns that indicate such activity.

Aggregated Information: We may aggregate Personal Data and use the aggregated information to
analyze the effectiveness of our Services, to improve and add features to our Services, and for other
similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics
of users of our Services and share aggregated information like general user statistics with prospective
business partners. We may collect aggregated information through the Services, through cookies, and
through other means described in this Privacy Policy.

6. SHARING AND DISCLOSURE OF PERSONAL DATA

In certain circumstances, we may share the categories of Personal Data described above without further
notice to you, unless required by the law, with the following categories of third parties:

• Vendors and Service Providers: To assist us in meeting business operations needs and to
  perform certain services and functions, we may share Personal Data with vendors and service
  providers, including providers of hosting services, cloud services, and other information
  technology services providers, email communication software and email newsletter services,
  advertising and marketing services, payment processors, customer relationship management
  and customer support services, and analytics services. Pursuant to our instructions, these parties
  will access, process, or store Personal Data in the course of performing their duties to us.
• Business Transfers: We may disclose your information to our subsidiaries and affiliates. If
  we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy,
  receivership, sale of all or a portion of our assets, or transition of service to another provider
  (collectively a “Transaction”), your Personal Data and other information may be shared in the
  diligence process with counterparties and others assisting with the Transaction and transferred
  to a successor or affiliate as part of that Transaction along with other assets.
• Legal Requirements: If required to do so by law or in the good faith belief that such
  action is necessary to (i) comply with a court order, regulatory request or other legal obligation,
  including to meet national security or law enforcement requirements, (ii) protect and defend our
  rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal
  safety of users of the Services, or the public, or (v) protect against legal liability.
• Enforcing our Rights: We may disclose your information as necessary to enforce our
  rights arising from any contracts entered into between you and us.
• Necessary for Purpose: We may disclose your information as necessary to fulfill the
  purpose for which you provided it.
• With Your Consent: We may disclose your information with your consent.
• Other purposes: We may disclose your information for any other purpose disclosed by
  us and accepted by you when you provide the information.

7. WHERE, HOW, AND HOW LONG WE STORE YOUR INFORMATION

Information collected through the Services is stored in a few different ways. As described above, certain
game data is stored only locally on your device or managed securely by Oculus. All other Personal Data
collected via the Services is stored securely using third-party vendors who implement industry standard
security measures. By using the Services, you authorize us to receive, process, transfer, and store your
information in and to the United States as applicable.

We keep your information only for the length of time necessary to fulfill the purposes for which the
information was collected. For example, if you sign up for our newsletter, we will keep your signup
information until you unsubscribe from it.

Cross-border Data Transfers: Where cross-border transfers of data are necessary, we will take
reasonable steps to safeguard the privacy of your Personal Data. These steps may include implementing
standard contractual clauses where recognized by law, obtaining your consent, or other lawful means of
transferring Personal Data.

8. DATA SECURITY

We have implemented measures designed to secure your Personal Data from accidental loss and from
unauthorized access, use, alteration, and disclosure by partnering with third parties who use
industry-standard security measures to protect your information. These measures include strict access
control policies, employee training, data encryption in transit via HTTPS, and the use of secure
third-party storage vendors.

Unfortunately, the transmission of information via the internet and mobile platforms is not completely
secure. Although we do our best to protect your Personal Data, we cannot guarantee the security of your
Personal Data transmitted through our Services. Any transmission of Personal Data is at your own risk.
We are not responsible for circumvention of any privacy settings or security measures we provide.

9. YOUR RIGHTS AND CHOICES

In certain circumstances, providing Personal Data is optional. However, if you choose not to provide
Personal Data that is needed to use some features of our Services, you may be unable to use those
features.

We strive to provide you with choices regarding the Personal Data you provide to us. This section
describes mechanisms we provide for you to control certain uses and disclosures of your information.

• Disabling Cookies: You can limit cookie collection by disabling cookies in your browser
  settings. Please note that if you limit the ability of websites to set cookies, you may be unable to
  access certain parts of the Services, and you may not be able to benefit from the full
  functionality of the Services. 
  • If you access the Services on your mobile device, you may not be able to control
    tracking technologies through the settings.
• Updating or correcting your information: Please contact us at the email address above if
  you need to change or correct your Personal Data.
• Promotion by us: If you have opted in to receiving email communications from us and
  you want us to discontinue using your email address to promote our own or third parties’
  products or Services, you can opt out by clicking the unsubscribe link at the bottom of our emails
  and following the instructions provided.
• Deleting Your Personal Data: We provide all of our data subjects with the Right to be
  Forgotten (also known as the Right to the Deletion of your Personal Data ), whether or not you
  reside or are a citizen of the European Union or the United Kingdom. Please email us at the
  address above if you would like us to delete your Personal Data.

Please note, however, that the Right to be Forgotten is not an absolute right. The Right to be
Forgotten only applies to the following types of Personal Data that are held by us at the time
of the request:

• Personal Data that was processed on the basis of consent,
• Personal Data that was processed on the basis of legitimate interests,
• Personal Data processed on a basis other than consent or legitimate interests
  that is no longer required for the purpose for which it was originally collected or
  processed,
• Personal Data that was processed unlawfully,
• Personal Data that must be deleted in order to comply with a legal obligation, or
• Personal Data of a child.

• Third parties: We do not control third parties’ collection or use of your information to
  serve interest-based advertising. However, these third parties may provide you with ways to
  choose not to have your information collected or used in this way.

For more information about the third parties that collect data through the Services, see the “Third Party
Information Collection” section above to understand which third parties have access to your Personal
Data through the Services. You can consult their privacy policies to see if they offer additional options for
limiting collection.

Data Rights of European Residents: The laws of the United Kingdom and the European Economic Area
and other territories provide their residents with certain data protection rights. If you are a resident of
the United Kingdom or the European Economic Area, these are your rights:

• The right to access – You have the right to request Company provide you with copies of
  your personal data. We may charge you a small fee for this service.
• The right to rectification – You have the right to request that the Company correct any
  information you believe is inaccurate. You also have the right to request that the Company
  complete information you believe is incomplete.
• The right to be forgotten – You have the right to request that the Company erase certain
  types of personal data (see Deleting Your Personal Data above).
• The right to restrict processing – You have the right to request that the Company restrict
  the processing of your personal data, under certain conditions.
• The right to object to processing – You have the right to object to the Company’s
  processing of your personal data, under certain conditions.
• The right to data portability – You have the right to request that Company transfer the
  data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these
rights, please contact us at privacy@windupminds.com.

10. CHANGES TO THE PRIVACY POLICY

The Services and our business may change from time to time. As a result, we may change this Privacy
Policy at any time. When we do, we will post an updated version on this page, unless another type of
notice is required by the applicable law. By continuing to use our Services or providing us with Personal

Data after we have posted an updated Privacy Policy, or notified you by other means if applicable, you
consent to the revised Privacy Policy and practices described in it.

11. CONTACT US

If you have any questions about our Privacy Policy or information practices, please feel free to contact us
at our designated request address: privacy@windupminds.com.