1. INTRODUCTION & ENTITY IDENTITY 

Prepvio LLC (“Prepvio,” “we,” “our,” or “us”) is a technology marketplace company incorporated and domiciled under the laws of the State of Texas, United States of America. We operate the Prepvio online marketplace platform (the “Platform”) available at prepvio.com and associated domains, which connects e-commerce sellers and fulfillment buyers (“Clients”) with independent prep center and third-party logistics operators (“Preppers”) for product inspection, labeling, bundling, kitting, storage, and fulfillment services.

For purposes of applicable data protection law including the UK GDPR, EU GDPR, and other privacy regulations, Prepvio LLC is the data controller of personal information collected through the Platform. This Policy sets forth the lawful basis, purposes, mechanisms, and conditions under which we collect, process, store, disclose, transfer, and protect personal information. It applies to all users of the Platform — including Clients, Preppers, visitors, prospective users, and any person whose data is collected through the Platform — regardless of their country of residence or location.

2. SCOPE, APPLICATION, & IMPORTANT LIMITATIONS OF LIABILITY

2.1 — Scope of This Policy

This Policy applies to personal information collected through: (a) the Prepvio website and Platform (prepvio.com and all associated subdomains); (b) the Prepvio mobile applications; (c) all email, messaging, chat, and support systems operated by Prepvio; and (d) any integrations, APIs, or connections operated by Prepvio.

2.2 — Critical Limitations of Liability & Disclaimers

IMPORTANT: This Policy does NOT apply to — and Prepvio accepts NO liability or responsibility whatsoever for the privacy practices, data handling, security, compliance practices, or content of: (i) third-party payment processors including Stripe, Inc., PayPal, or any other payment service provider; (ii) third-party marketplaces and platforms including Amazon, Walmart, eBay, TikTok Shop, or any other marketplace or sales platform; (iii) carriers, logistics providers, and shipping services; (iv) any identity verification services or third-party vendors; or (v) any other third-party websites, applications, services, or integrations linked from, referenced in, or partnered with the Platform.

Your use of any third-party service is governed exclusively by that service’s own privacy policies, terms of service, and data handling practices. Prepvio makes no representation regarding the legality, compliance, appropriateness, or adequacy of any third party’s data practices in any jurisdiction.

2.3 — Jurisdiction-Specific Notice

Prepvio makes no representation that the Platform, its data practices, or this Policy are lawful, appropriate, or compliant in every jurisdiction. If you access the Platform from a jurisdiction with stricter, different, or more restrictive data protection, privacy, or content regulations than those of the United States, you do so entirely at your own risk. Prepvio shall not be liable for any non-compliance with local laws.

3. WHAT PERSONAL INFORMATION WE COLLECT

■ Account & Registration Information: Full legal name, username, email address, phone number, password (hashed), account type designation (Client or Prepper), and country of residence.

■ Profile & Business Information: Business name, business registration details, service descriptions, pricing, service categories, turnaround times, facility photos and videos, capacity limits, shipping/item restrictions, certifications, and other listing details you choose to provide.

■ Identity & Verification Documents: Government-issued ID (driver’s license, passport), business registration certificates, proof of address, business license, tax identification documents, and any other documents required for identity verification or account feature unlocking. Submission of verification documents is optional unless required to unlock specific features (such as publishing Gigs, accepting Orders, or processing payouts). You maintain the option to decline verification and use the Platform with limited features.

■ Payment & Financial Information: Billing address, payment method type (card, bank account), payout bank account details, transaction history, and payment status. IMPORTANT: Full payment card numbers are NEVER transmitted to or stored by Prepvio servers. All card data is collected, processed, and stored exclusively by Stripe, Inc. pursuant to PCI DSS compliance standards. Prepvio only receives tokenized payment data and transaction records.

■ Communication Content: In-Platform messages and chats with other users, support tickets and inquiries, dispute submissions and supporting evidence, written feedback, reviews, ratings, and email correspondence with Prepvio.

3.2 — Information Collected Automatically

■ Usage & Activity Data: Pages and features accessed, search queries and filters used, clicks and navigation patterns, time spent on pages, session start and end times, referral sources and marketing attribution, and complete timestamps for all activities.

■ Device & Technical Information: IP address (and derived approximate location), browser type, browser version, operating system, device type, device identifiers (where applicable), screen resolution, language preferences, time zone, and installed browser extensions or plugins.

■ Cookies & Similar Tracking Technologies: HTTP cookies, persistent cookies, session cookies, web beacons, pixels, local storage, and similar client-side storage mechanisms. See Section 09 for detailed cookie disclosure.

■ Approximate Location Data: General geographic location derived from your IP address (typically at the city or regional level), used for fraud prevention, legal compliance, and service localization. We do NOT collect GPS location, precise location data, or continuously track your movements.

■ Derived or Inferred Data: Aggregated, anonymized usage patterns, inferred preferences and interests, and behavioral segments created through analytics and machine learning, used for service improvement and fraud detection.

3.3 — Information from Third Parties

■ Payment processors and payment status records (e.g., Stripe, Inc.).

■ Fraud detection and risk scoring services (e.g., Stripe Radar, third-party fraud vendors).

■ Identity verification and background check services.

■ Analytics platforms and web traffic analysis tools.

■ Public business registries, corporate databases, and business registration authorities.

■ Social login providers if you choose to authenticate via third-party account (e.g., Google, Facebook).

4. PURPOSES OF DATA PROCESSING

We process personal information for the following business and legal purposes:

■ Platform Operation & Service Delivery: Creating and maintaining your account, authenticating your identity on login, publishing and managing your Gigs and listings, matching Clients with Preppers, processing Orders, facilitating payments and payouts, enabling in-Platform messaging and communications, and providing customer support.

■ Security & Fraud Prevention: Identity and business verification, detection and investigation of fraudulent activity, abuse, unauthorized access, prohibited conduct, Terms violations, and illegal activity, including use of automated fraud detection systems.

■ Legal & Regulatory Compliance: Compliance with applicable federal, state, and local law and regulation, response to lawful government requests and court orders, tax reporting obligations (including IRS Form 1099-K for qualifying users), anti-money laundering (AML) and know-your-customer (KYC) compliance, and sanctions screening.

■ Service Improvement & Analytics: User experience analytics, A/B testing and feature testing, bug identification and resolution, performance monitoring, usage trend analysis, capacity planning, feature development, and research into Platform optimization.

■ Communications: Transactional notices (Order confirmations, payment processing, security alerts, policy updates), and marketing communications (product announcements, platform updates, promotional offers) where permitted by law and your consent, with easy opt-out available at any time.

■ Business Operations: Financial accounting and bookkeeping, audit and compliance programs, insurance and risk management, litigation and legal defense, due diligence for corporate transactions, and internal quality assurance.

■ Dispute Resolution & Enforcement: Investigation of disputes between Clients and Preppers, mediation and resolution of claims, enforcement of our Terms and Conditions, protection of Prepvio’s intellectual property and contractual rights, and pursuit of remedies for breach or violation.

■ Protection of Rights & Safety: Protection of the rights, property, and physical safety of Prepvio, our users, and the general public, including investigation and prevention of harm, fraud, and illegal activity.

5. LEGAL BASES FOR PROCESSING (GDPR / UK DATA PROTECTION LAW)

For users located in the United Kingdom or European Economic Area, Prepvio processes personal data pursuant to one or more of the following legal bases:

• Contractual Necessity
• Legitimate Interests
• Consent
• Legal Obligations
• Vital Interests or Public Interest where permitted by law

These legal bases are used depending on the nature of the service being provided and the type of data being processed.

Users may exercise applicable privacy rights by contacting support@prepvio.com.

6. DISCLOSURE & SHARING OF PERSONAL INFORMATION

Prepvio does NOT sell, rent, lease, trade, or transfer your personal information to any third party for monetary or other valuable consideration under any circumstances. Information is disclosed only as follows:

■ With Other Users (Transaction-Necessary Only): Limited profile information and Order details are shared between Clients and Preppers solely to enable a confirmed, active transaction. This may include name, business name, service type, Gig details, and Order specifications. Prepper facility addresses are disclosed only to Clients with an accepted, confirmed, active Order. All address information is subject to confidentiality and may not be used for any purpose outside the transaction.

■ With Service Providers & Data Processors: Vetted third-party vendors who act as data processors on our behalf, subject to written Data Processing Agreements (DPAs) incorporating GDPR, CCPA, and other applicable requirements. Processors include: hosting providers, payment processors (Stripe, Inc.), email delivery services, identity verification vendors, analytics tools, fraud detection systems, customer support platforms, and business communication tools.

■ With Legal & Regulatory Authorities: Where required by applicable law, regulation, court order, subpoena, or governmental directive; where necessary to protect the safety, rights, or property of Prepvio, our users, or the public; or to investigate fraud, illegal activity, or Terms violations.

■ In Corporate Transactions: In connection with a merger, acquisition, financing, restructuring, asset sale, or other corporate transaction, subject to confidentiality obligations and notice to affected users where legally required. Acquirers will be bound by this Policy or obligated to provide notice of material changes.

■ To Enforce Rights & Protect the Platform: To detect, prevent, investigate, or address fraud, abuse, security threats, illegal activity, Terms violations, or threats to the physical safety of any person or the integrity of the Platform.

■ With Your Explicit Written Consent: For any other purpose you specifically authorize in writing through a signed consent form, email, or other verifiable means.

IMPORTANT: Prepvio does not provide direct marketing lists, email addresses, or personal information to third-party marketers, advertisers, or commercial entities. We may use your information for Prepvio’s own marketing purposes, from which you may opt out at any time.

7. INTERNATIONAL DATA TRANSFERS & MECHANISMS

Prepvio is headquartered in the United States. Our infrastructure, service providers, and back-office operations may be located in the United States or other countries. If you access the Platform from outside the United States — including from Pakistan, India, Bangladesh, Nepal, the United Kingdom, or the European Economic Area — your personal information will be transferred to, stored, and processed in the United States and potentially other jurisdictions.

For UK / EEA Users — Transfer Mechanisms: We rely on one or more lawful mechanisms to legitimize such transfers, including:

■ International Data Transfer Agreement (IDTA) and UK Addendum (as applicable to UK recipients).

■ EU Standard Contractual Clauses (SCCs) for transfers from EEA to third countries.

■ Adequacy decisions where applicable.

■ Other mechanisms permitted by applicable law.

By using the Platform, you acknowledge that your data will be transferred, stored, and processed outside your country of origin, potentially in jurisdictions with different data protection standards, and you consent to such transfers.

LIMITATION OF LIABILITY FOR FOREIGN JURISDICTIONS: Prepvio accepts NO liability whatsoever for the data protection laws, regulations, government actions, surveillance practices, or other conduct of any foreign jurisdiction that is beyond our reasonable control. Users accessing the Platform from jurisdictions with restrictive data protection laws do so at their own risk.

8. DATA SECURITY MEASURES & LIMITATIONS

Prepvio implements commercially reasonable administrative, technical, and physical security measures to protect personal information against unauthorized access, loss, destruction, alteration, or disclosure, including:

■ Encryption of all data in transit via TLS 1.2+ protocols (HTTPS).

■ Secure hashing and salting of authentication credentials using industry-standard algorithms.

■ Role-based access controls (RBAC) and the principle of least privilege for internal data access.

■ Regular security assessments, vulnerability scanning, and penetration testing.

■ Incident response procedures, logging, and audit trails.

■ Data processing agreements and security requirements binding all third-party vendors.

■ Employee confidentiality and background screening procedures.