Regional Privacy Supplements

Section 01

How these supplements apply

These supplements add to the Privacy Policy and Consumer Health Data Privacy Notice. A section applies only when the cited law covers Revenge Arc’s activity and you are entitled to its protections. Rights, exceptions, verification, timing, and appeals vary by location. The launch countries, states, legal entity, revenue and processing thresholds, and representative obligations must be confirmed before final publication.

Section 02

California

If the California Consumer Privacy Act applies, California residents may have rights to know the categories and specific pieces of personal information collected, sources, purposes, categories of recipients, access, correction, deletion, portability, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service without unlawful discrimination. The Privacy Policy describes the current categories, sources, purposes, and recipients.

Revenge Arc does not currently sell personal information or share it for cross-context behavioral advertising. If a covered sale or sharing practice begins, an appropriate opt-out method and recognition of legally required browser preference signals, including Global Privacy Control where applicable, must be implemented before the practice begins. Authorized-agent requests may require proof of authority and identity verification.

Section 03

Washington consumer health data

If Washington’s My Health My Data Act applies, a consumer may have rights to confirm collection or sharing of consumer health data, access that data, receive a list of relevant recipients, withdraw consent, request deletion, and appeal a refusal. Separate authorization is required before a covered sale. See the Consumer Health Data Privacy Notice for categories, sources, purposes, sharing, and request instructions.

Section 04

Other United States states

Residents of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, and other states may have some combination of access, correction, deletion, portability, opt-out, sensitive-data consent, authorized-agent, and appeal rights if the relevant law applies. The exact list and wording must be reconciled with launch timing, statutory thresholds, exemptions, and current practices before publication.

Nevada residents may submit a verified request concerning a covered sale as defined by Nevada law even when broader privacy-law thresholds do not apply. Revenge Arc does not currently sell covered information.

Section 05

EEA and United Kingdom

If EU or UK data-protection law applies, the final notice must identify the controller, purposes, legal bases, special-category conditions, recipients, retention, international-transfer safeguards, and any required representative or data protection officer. Depending on the processing, rights may include access, correction, deletion, restriction, portability, objection, consent withdrawal, and a complaint to the applicable supervisory authority.

Revenge Arc does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects. Any sensitive health information or biometric identifier requires an applicable legal condition and, where required, explicit consent. Actual provider regions and transfer mechanisms must be confirmed before offering the Services in these markets.

Section 06

Canada and other regions

If Revenge Arc launches in Canada or another country with additional privacy rules, the public notice, consent design, access and correction process, cross-border disclosures, complaint route, and local representative requirements must be localized before launch there. Publishing this draft does not by itself mean the Services are offered in every jurisdiction.

Section 07

Requests and appeals

Send privacy requests, authorized-agent submissions, and appeals to revengearchelp@gmail.com. Describe the right and account involved without including passwords, authentication codes, full payment-card numbers, or unnecessary health information. We may verify identity, residence, and authority, and will respond within the period required by applicable law.