MobileFlow Inc. Ci Terms of Service

Effective Date: July 13, 2026

These Terms of Service govern access to and use of Ci, including Ci mobile applications, websites, dashboards, communications, and related services. Please read them carefully. The Privacy Policy following these Terms explains how MobileFlow Inc. handles personal information in connection with Ci.

IMPORTANT NOTICE REGARDING ARBITRATION: THESE TERMS CONTAIN A BINDING INDIVIDUAL ARBITRATION AGREEMENT AND CLASS ACTION WAIVER IN SECTION 18. UNLESS YOU TIMELY OPT OUT, DISPUTES BETWEEN YOU AND MOBILEFLOW INC. GENERALLY MUST BE RESOLVED THROUGH INDIVIDUAL ARBITRATION, NOT IN COURT OR BY A JURY.

1. ACCEPTANCE OF THESE TERMS

These Terms of Service (the “Terms”) are a binding agreement between you and MobileFlow Inc. (“MobileFlow,” “we,” “us,” or “our”) concerning the Ci service (“Ci” or the “Service”). Ci helps fans, artists, promoters, venues, and labels coordinate live-music engagement, invitations, attendance, communications, rewards, and related activities.

By creating an account, accessing Ci, clicking to accept these Terms, or otherwise using the Service, you agree to these Terms and the Ci Privacy Policy. If you do not agree, do not use Ci. If you use Ci on behalf of an organization, you represent that you have authority to bind that organization, and “you” includes the organization.

We may provide additional terms for a particular feature, promotion, subscription, reward, or beta program. Those additional terms become part of these Terms when you use the applicable feature. If they conflict with these Terms, the feature-specific terms control for that feature.

2. ELIGIBILITY AND ACCOUNT ROLES

You must be at least 16 years old to use Ci. If the age of legal majority where you live is older than 16, you may use Ci only with the permission and supervision of a parent or legal guardian. You may not use Ci if you are barred from receiving services under applicable law or if we previously suspended or terminated you for material violations.

Ci may support several account roles, including fan, artist, promoter, venue administrator, and label administrator. Features, permissions, and responsibilities vary by role. You agree to select an accurate role and to use administrative access only for an organization you are authorized to represent.

You must provide accurate, current information and keep it updated. You are responsible for maintaining the confidentiality of your credentials and for activity under your account. Notify us promptly at holt@celebintel.com if you believe your account or credentials have been compromised.

Ci may permit authentication through email, password, magic link, phone verification, or a linked MobileFlow or Hytch account. Linking services may associate your Ci profile with an existing MobileFlow identity. You must control the email address or phone number used to authenticate.

3. THE CI SERVICE

Subject to these Terms, Ci may provide some or all of the following:

artist, fan, promoter, venue, and label profiles;

show and event creation, invitations, RSVPs, referral links, guest lists, and attendance history;

QR codes, device signals, location evidence, and other tools used to evaluate check-in or attendance;

fan engagement metrics, fan scores, experience points, streaks, draw estimates, campaign analytics, pitch materials, and other derived insights;

contact matching that helps users find people they may know on Ci;

media uploads, show photos or videos, setlists, reactions, and other user content;

Spotify account linking and music-listening insights;

push notifications, emails, service messages, and subscriber chat;

paid subscriptions, chat entitlements, venue or event spending records, rewards, and other transaction features; and

optional SafeRide coordination or similar safety-oriented features when enabled.

Features may be experimental, unavailable in some locations, limited by role, or changed without notice. We do not guarantee that any particular artist, fan, venue, promoter, label, show, reward, or third-party service will be available.

Ci may rely on shared MobileFlow backend systems, including modern-api and Hytch service infrastructure. This allows Ci to support identity linking, rewards, subscriber chat, and related functions across MobileFlow services. A linked Hytch feature may also be subject to Hytch-specific terms presented with that feature.

4. SHOWS, INVITATIONS, ATTENDANCE, AND LOCATION

Artists, promoters, venues, and other authorized hosts may create or manage show information, send invitations, view responses, evaluate attendance, and access analytics. Hosts must have authority to publish the show information and contact the intended recipients.

Fans may respond to invitations, refer others, check in, submit attendance evidence, and participate in show-related activities. An RSVP, invitation, referral, or Ci status does not guarantee admission, a ticket, a reserved seat, accessibility accommodation, or entry to a venue. Venue and ticket-provider rules continue to apply.

Ci may use QR scans, timestamps, show location, device identifiers, distance calculations, or other signals to assess attendance and reduce fraud. A check-in may be rejected, delayed, reviewed, or reversed if the evidence is incomplete, inconsistent, duplicated, manipulated, or outside applicable time or location limits. You must not falsify attendance or attempt to earn benefits for an event you did not attend.

Location features generally operate while you actively use a relevant feature, such as creating a show location, checking in, or confirming arrival. Device permission settings control whether Ci can access precise location. Disabling location may prevent some verification, invitation, or analytics features from working. Never use Ci in a way that distracts you while driving or creates an unsafe situation.

Hosts may see verified attendance information and, subject to the fan’s visibility settings, profile or home-city information. If a fan restricts profile or location sharing, Ci may still provide a pseudonymous or aggregated attendance count so that a host can measure verified turnout without receiving the restricted profile fields.

5. CONTACT MATCHING AND INVITATIONS

If you choose contact matching, Ci will ask for device permission and confirmation before reading contact phone numbers. Ci may normalize those numbers and send them to our systems to find matching users. We may retain a cryptographic hash of a normalized phone number, an optional contact label, and a matching Ci user identifier. A hash reduces exposure but is still handled as personal information under this Privacy Policy where applicable.

Do not upload contact information unless you are permitted to use it for the requested purpose. Contact matching is not authorization to send spam, unlawful marketing, or unwanted repeated invitations. Respect requests to stop communicating.

6. USER CONTENT AND PUBLIC PROFILES

“User Content” means information or material submitted, posted, transmitted, recorded, or made available through Ci, including profile information, artist pages, show details, setlists, photos, videos, messages, reactions, reports, notes, and feedback.

You retain ownership of your User Content. You grant MobileFlow a worldwide, nonexclusive, royalty-free, sublicensable, and transferable license to host, store, reproduce, modify for formatting or technical purposes, display, perform, distribute, and otherwise use User Content as reasonably necessary to operate, secure, improve, promote, and provide Ci. For content you intentionally make public, this license includes displaying it to the public and allowing it to be shared through Ci. The license ends when the content is deleted from our active systems, except for reasonable backup retention, legal obligations, previously authorized uses, and content retained by other users where applicable.

You represent that you own or have all rights needed for your User Content and that it does not violate law, contract, privacy, publicity, copyright, trademark, or other rights. You are responsible for obtaining music, performer, venue, and attendee permissions needed for uploaded recordings or images.

Some artist or show profiles may be public and indexed or shared outside Ci. Review your profile and visibility settings before posting. Information sent to another user can be copied or redistributed by that person, even if Ci later deletes the original.

We may review, restrict, remove, preserve, or disclose User Content when we reasonably believe it violates these Terms, creates risk, is unlawful, infringes rights, or is necessary to protect Ci or others. We are not obligated to monitor all content and do not endorse User Content.

7. SUBSCRIBER CHAT AND COMMUNICATIONS

Ci may offer direct, room-based, or subscriber chat involving fans, artists, promoters, or authorized team members. Subscriber chat messages are stored and processed through MobileFlow’s modern-api or Hytch infrastructure. These chats are not end-to-end encrypted. MobileFlow systems and authorized personnel or service providers may be able to access message content for delivery, support, safety, moderation, fraud prevention, legal compliance, or enforcement.

Do not use Ci chat for highly sensitive information, emergency communications, financial account credentials, medical information, or information you are not authorized to share. A message marked delivered or read does not guarantee that the intended person personally received or reviewed it.

Ci may provide reporting, blocking, moderation, handoff, or entitlement tools. We may use automated rules and human review to detect suspected abuse or enforce policies, but we cannot prevent all harmful conduct. If you are in immediate danger, contact local emergency services.

You consent to receiving transactional communications needed to operate your account, including authentication, invitations, attendance, security, payment, support, and policy notices. You may control optional marketing messages through settings or unsubscribe instructions. Carrier messaging and data rates may apply.

8. SPOTIFY AND OTHER CONNECTED ACCOUNTS

If you connect Spotify, Ci may request access to your Spotify profile email, top artists and tracks, recently played music, and related listening information within the scopes shown during authorization. Ci may use this information to personalize your experience, create music-interest insights, support artist or fan analytics, and improve recommendations or engagement features.

You may disconnect Spotify through Ci or Spotify account controls. Disconnecting stops new authorized access but does not automatically delete information already imported or insights already created. You may separately request deletion as described in the Privacy Policy. Your Spotify use remains governed by Spotify’s terms and privacy policy.

Other connected accounts are subject to the third party’s terms. We do not control and are not responsible for a third party’s service, data practices, availability, or decisions.

9. PAYMENTS, SUBSCRIPTIONS, REWARDS, AND TAXES

Ci may offer paid subscriptions, subscriber-chat access, event spending features, rewards, credits, or other paid or promotional programs. Prices, billing intervals, renewal terms, included benefits, and cancellation options will be shown at purchase. Payments may be processed by Apple, Stripe, or another payment provider. Their terms also apply.

Unless the purchase screen states otherwise, subscriptions automatically renew until canceled. You must cancel through the platform or account used to subscribe before renewal to avoid the next charge. Refunds are governed by applicable law and the payment platform’s rules. We may change future pricing or benefits with notice required by law.

Rewards, credits, experience points, fan scores, streaks, badges, or similar items are promotional features, not money, property, securities, stored value, or a guarantee of payment. They may be subject to eligibility rules, verification, expiration, limits, sponsor funding, taxes, and program changes. They have no cash value unless a specific program expressly states otherwise. We may withhold, reverse, or cancel benefits associated with fraud, error, abuse, chargeback, or ineligible activity.

Venue spending or event-payment records may include amounts, currency, category, and processor identifiers. Ci is not a bank or payment institution. You are responsible for taxes associated with payments, rewards, sales, services, or benefits you receive, except taxes imposed on MobileFlow’s income.

10. SAFERIDE AND SAFETY-ORIENTED FEATURES

When enabled, SafeRide may help users coordinate a ride, identify a driver and riders, scan a session code, confirm proximity or arrival, or award promotional points. SafeRide is a coordination tool. MobileFlow is not a transportation carrier, taxi service, rideshare company, emergency service, or insurer, and does not employ or supervise drivers.

SafeRide does not verify sobriety, licensing, insurance, vehicle condition, driving ability, identity, or personal safety. Users must exercise independent judgment, follow law, wear seat belts, avoid impaired or distracted driving, and use licensed emergency or transportation services when appropriate. Never rely on SafeRide as a substitute for calling emergency services.

Drivers and riders assume the ordinary risks of arranging and participating in transportation. To the maximum extent permitted by law, MobileFlow is not responsible for acts or omissions of a driver, rider, venue, host, or other user. Nothing in this section limits liability that cannot lawfully be excluded.

11. PROFESSIONAL AND ADMINISTRATIVE USERS

Artists, promoters, venues, labels, and their administrators must:

use only truthful, authorized profiles and event information;

secure all rights needed for names, logos, music, media, promotions, guest lists, and communications;

honor applicable ticketing, accessibility, consumer-protection, employment, and advertising laws;

limit access to authorized personnel and promptly remove access when a person’s role ends;

use fan data only for legitimate Ci-related purposes and consistent with visibility controls, law, and any agreement with MobileFlow;

avoid exporting, combining, or using fan information for discriminatory, invasive, or unrelated purposes; and

provide legally required notices and obtain legally required consents for their own independent processing.

Professional dashboards and estimates are decision-support tools. Attendance, fan score, draw, spend, engagement, and campaign metrics may be incomplete, delayed, modeled, or affected by user settings and available evidence. Do not treat them as audited financial statements or guarantees of ticket sales, attendance, revenue, or performance.

12. ACCEPTABLE USE

You may not, and may not assist another person to:

violate law, regulation, contract, court order, or another person’s rights;

harass, threaten, stalk, exploit, discriminate against, or impersonate anyone;

post unlawful, defamatory, obscene, sexually exploitative, hateful, or dangerously deceptive content;

send spam, scrape users, buy or sell account access, or use contact matching for unrelated solicitation;

manipulate invitations, referrals, location, QR codes, attendance, spending, streams, rewards, fan scores, or analytics;

submit malware, overload the Service, bypass security or rate limits, or probe systems without written authorization;

reverse engineer, decompile, or derive source code except where law expressly permits it;

use bots or automated tools to access Ci without our written permission;

copy, resell, rent, sublicense, or commercially exploit Ci except through an authorized feature or written agreement;

collect or expose personal information about another person without lawful authority; or

use Ci to train, benchmark, or develop a competing product or model without our written permission.

We may investigate suspected violations and cooperate with lawful requests. Enforcement decisions may include warnings, feature limits, reversal of rewards, content removal, suspension, or termination.

13. INTELLECTUAL PROPERTY

Ci, including its software, design, text, graphics, logos, interfaces, compilation, and underlying technology, is owned by MobileFlow or its licensors and protected by intellectual-property laws. Except for the limited right to use Ci under these Terms, no rights are granted to you.

Subject to your compliance with these Terms, MobileFlow grants you a limited, personal, nonexclusive, nontransferable, nonsublicensable, revocable right to access and use Ci for its intended purposes. Professional users may use authorized dashboards for internal business purposes.

If you submit feedback, you grant MobileFlow an unrestricted, perpetual, irrevocable, worldwide, royalty-free right to use it without compensation or attribution.

14. COPYRIGHT COMPLAINTS

If you believe content on Ci infringes your copyright, send a notice to holt@celebintel.com with: your physical or electronic signature; identification of the copyrighted work; identification and location of the allegedly infringing material; your contact information; a statement of good-faith belief; and a statement under penalty of perjury that the notice is accurate and you are authorized to act. We may request additional information and may terminate repeat infringers where appropriate.

15. THIRD-PARTY SERVICES

Ci may interoperate with Apple, Spotify, Stripe, Google, Expo, email providers, cloud-storage providers, venues, ticketing services, and other third parties. Links or integrations do not imply endorsement. Third parties may change or discontinue their services, and their terms and privacy practices govern their systems.

MobileFlow is not responsible for third-party content, transactions, outages, security, or conduct. You authorize us to exchange information with a connected service as reasonably necessary to provide the integration you request.

16. CHANGES, BETA FEATURES, AND AVAILABILITY

Ci may change over time. We may add, modify, suspend, or discontinue a feature or the Service, subject to applicable law and any specific paid commitment. Beta or experimental features may contain errors and may be changed or withdrawn at any time.

We may update these Terms. If a change is material, we will provide notice through Ci, email, or another reasonable method before the change becomes effective when required by law. Continued use after the effective date means you accept the revised Terms. If you do not agree, stop using Ci and cancel applicable subscriptions.

17. SUSPENSION, TERMINATION, AND ACCOUNT DELETION

You may stop using Ci at any time and may request account deletion through available in-app controls or by contacting us. Cancel paid subscriptions separately through the applicable payment platform.

We may suspend or terminate access if we reasonably believe you violated these Terms, created risk or legal exposure, engaged in fraud or abuse, failed to pay, or if required by law. Where appropriate, we may provide notice or an opportunity to appeal.

Deletion removes or de-identifies account information from active Ci systems subject to technical, legal, security, payment, fraud-prevention, and recordkeeping exceptions. Some records may remain where another user or organization has an independent record, where identifiers are replaced with null or anonymous values, in secure backups for a limited period, or in shared MobileFlow systems until their applicable retention cycle completes. Public or shared content copied by others may remain outside our control.

Sections that by their nature should survive termination will survive, including ownership, payment obligations, disclaimers, limitations of liability, indemnity, dispute resolution, and general terms.

18. DISPUTE RESOLUTION, ARBITRATION, AND CLASS ACTION WAIVER

Please read this section carefully. It affects your legal rights.

Informal resolution. Before filing a claim, you and MobileFlow agree to try to resolve it informally for at least 30 days. A notice to MobileFlow must be sent to holt@celebintel.com and include your name, account contact information, a description of the dispute, and the relief requested. We will send notices to the contact information associated with your account.

Agreement to arbitrate. Except for excluded claims below, any dispute arising out of or relating to Ci, these Terms, or your relationship with MobileFlow will be resolved by binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules, as modified by these Terms. The Federal Arbitration Act governs this arbitration provision. The arbitrator may award the same individual remedies available in court and must apply applicable statutes of limitation.

Excluded claims. Either party may bring an individual claim in small claims court if it qualifies. Either party may seek injunctive or equitable relief in a court of competent jurisdiction for actual or threatened infringement, misappropriation, or unauthorized use of intellectual property or confidential information. Government agencies may enforce rights within their authority.

No class proceedings. You and MobileFlow agree that claims may be brought only in an individual capacity, not as a plaintiff or class member in a class, collective, coordinated, consolidated, mass, or representative proceeding. The arbitrator may not combine claims of more than one person without every party’s consent.

Opt out. You may opt out of this arbitration agreement by emailing holt@celebintel.com within 30 days after you first accept these Terms. Your notice must state your full name, the email address or phone number associated with your Ci account, and a clear statement that you opt out of arbitration. Opting out will not affect other Terms or your access to Ci.

Fees and location. Payment of arbitration fees will be governed by the AAA rules and applicable law. Arbitration may occur by video, telephone, written submissions, or in a reasonably convenient location. If a court determines that a particular restriction in this section is unenforceable as to a specific claim or remedy, that claim or remedy will proceed in court after all arbitrable matters are resolved.

19. DISCLAIMERS

TO THE MAXIMUM EXTENT PERMITTED BY LAW, CI IS PROVIDED “AS IS” AND “AS AVAILABLE.” MOBILEFLOW DISCLAIMS ALL EXPRESS, IMPLIED, AND STATUTORY WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

MOBILEFLOW DOES NOT WARRANT THAT CI WILL BE UNINTERRUPTED, SECURE, ERROR-FREE, OR ACCURATE; THAT CONTENT OR DATA WILL BE PRESERVED; THAT USERS ARE WHO THEY CLAIM TO BE; OR THAT A SHOW, INVITATION, CHECK-IN, REWARD, PAYMENT, RIDE, MESSAGE, OR THIRD-PARTY SERVICE WILL MEET YOUR EXPECTATIONS. YOU ARE RESPONSIBLE FOR BACKUPS OF CONTENT IMPORTANT TO YOU.

CI DOES NOT PROVIDE LEGAL, FINANCIAL, MEDICAL, SECURITY, TRANSPORTATION, OR EMERGENCY ADVICE. LOCATION, ATTENDANCE, SAFETY, AND ANALYTICS FEATURES ARE INFORMATIONAL TOOLS AND DO NOT REPLACE PROFESSIONAL JUDGMENT OR EMERGENCY SERVICES.

Some jurisdictions do not allow certain disclaimers, so some of the above may not apply to you.

20. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW, MOBILEFLOW AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, LICENSORS, AND SERVICE PROVIDERS WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATING TO CI, EVEN IF ADVISED OF THE POSSIBILITY.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE TOTAL LIABILITY OF MOBILEFLOW AND THE PARTIES LISTED ABOVE FOR ALL CLAIMS ARISING OUT OF OR RELATING TO CI OR THESE TERMS WILL NOT EXCEED THE GREATER OF: (A) THE AMOUNT YOU PAID MOBILEFLOW FOR CI DURING THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY; OR (B) ONE HUNDRED U.S. DOLLARS.

These limits apply regardless of legal theory and even if a remedy fails of its essential purpose. They do not limit liability that cannot be limited by law, including certain liability for fraud, willful misconduct, or personal injury caused by negligence where applicable.

21. INDEMNITY

To the extent permitted by law, you will defend, indemnify, and hold harmless MobileFlow and its affiliates, officers, directors, employees, contractors, licensors, and service providers from claims, liabilities, damages, judgments, losses, costs, and reasonable legal fees arising from your User Content, your violation of these Terms or law, your misuse of Ci, or your infringement of another person’s rights. MobileFlow may control the defense and settlement, and you agree to cooperate. This section does not apply to the extent prohibited by law.

22. GOVERNING LAW

The Federal Arbitration Act governs Section 18. Except where applicable consumer law requires otherwise, these Terms and disputes not subject to arbitration are governed by the laws of the State of Delaware, without regard to conflict-of-law principles. Subject to Section 18, you and MobileFlow consent to exclusive jurisdiction in the state and federal courts located in Delaware.

23. GENERAL TERMS

These Terms and incorporated policies are the entire agreement between you and MobileFlow concerning Ci, unless a separate signed agreement applies. If a provision is unenforceable, it will be modified to the minimum extent necessary and the remaining provisions remain effective. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent. We may assign them in connection with a merger, reorganization, sale of assets, or by operation of law. No third party is a beneficiary except as expressly stated. Headings are for convenience only. Electronic notices and records satisfy written requirements where permitted by law.

24. CONTACT

Questions about these Terms or Ci may be sent to:

MobileFlow Inc.

Email: holt@celebintel.com

MobileFlow Inc. Ci Privacy Policy

Effective Date: July 13, 2026

This Privacy Policy explains how MobileFlow Inc. collects, uses, discloses, and protects personal information in connection with Ci. It also describes choices and privacy rights that may be available to you.

1. SCOPE AND WHO WE ARE

MobileFlow Inc. (“MobileFlow,” “we,” “us,” or “our”) operates Ci for fans, artists, promoters, venues, labels, and their authorized users. This Privacy Policy applies to Ci mobile applications, websites, dashboards, communications, and related services that link to it.

It does not govern a third party’s independent service or a professional user’s independent use of information outside Ci. For example, a venue or artist may independently collect ticket purchaser information under its own privacy notice. When MobileFlow processes information solely on behalf of a business customer under a written agreement, that customer may be responsible for responding to your privacy request for that information.

Ci uses shared MobileFlow service infrastructure, including modern-api and Hytch systems, for certain identity, reward, subscriber-chat, and related features. This Policy covers MobileFlow’s handling of Ci information across those systems.

2. INFORMATION WE COLLECT

We collect information you provide, information generated through your use of Ci, information from connected services, and information from other users or partners.

Account and profile information. We may collect your name or display name, handle, email address, phone number, password hash, profile photo, home city, approximate home coordinates, account role, organization, social links, biography, preferences, and account-consent records. We store authentication tokens or verification records needed to keep you signed in and secure your account. On a supported device, application tokens are stored using the device’s secure storage features.

Professional and organization information. For artists, promoters, venues, labels, and administrators, we may collect stage or business name, team membership, role, venue details, artist identifiers, show roster, authorization status, booking or campaign information, and administrative activity.

Shows, invitations, referrals, and attendance. We collect show name, venue, address, date and time, geographic coordinates, invitation and RSVP status, referral relationships, guest-list activity, QR codes or scan results, check-in attempts, attendance status, timestamps, verification evidence, distance calculations, audit events, and related notes.

Location information. With device permission, we may receive precise or approximate location while you actively use a location-dependent feature. We may also infer location from an event address, IP address, home city, or information you submit. Ci does not need continuous background location for the ordinary check-in flow described in the current application, but device and operating-system behavior may vary.

Contacts. If you choose contact matching and confirm the upload, we may process phone numbers from selected or available device contacts. We normalize them to look for matching accounts and may retain a cryptographic phone-number hash, an optional contact label, and a matched user identifier. We do not need to retain the raw address-book number in Ci’s contact-match record after hashing and matching.

User Content and communications. We collect profile content, artist pages, setlists, photos, videos, show media, reactions, messages, support requests, reports, block records, moderation decisions, and other content you submit. Media may contain metadata depending on your device and upload settings.

Subscriber chat. We collect room membership and subject information, handoff and entitlement status, plaintext message bodies, sent and read timestamps, reports, report reasons, review notes, moderation status, and block information. Subscriber chat is not end-to-end encrypted. Message content is processed through MobileFlow’s modern-api or Hytch infrastructure and may be accessible to authorized systems, personnel, and providers for the purposes described in this Policy.

Spotify information. If you connect Spotify, we may receive your Spotify user identifier, display name, email within the authorized scope, authorization scopes, access and refresh tokens, top artists, top tracks, recently played items, genres, listening timestamps, track and artist identifiers, and derived music-interest or audio-profile information. Tokens are protected using application and infrastructure controls, but no system is perfectly secure.

Transactions and rewards. We may collect subscription status, product or entitlement, payment-provider customer or transaction identifiers, Stripe account, payment-intent or charge identifiers, purchase amount, currency, spending category, transaction status, reward opportunity and redemption identifiers, sponsor or venue identifiers, credits, ledger status, payout status where enabled, and timestamps. Payment providers generally collect full payment-card details directly; MobileFlow typically receives a token or identifier and transaction details rather than the complete card number.

SafeRide information. When SafeRide is enabled, we may collect a session code, driver or rider role, MobileFlow user identifier, origin or geofence, participation status, arrival or completion time, distance or proximity evidence, reward points, and payout status where a program provides one.

Device, technical, and usage information. We may collect device and platform type, application version, IP address, push token, browser type, operating system, identifiers used for security or abuse detection, pages or screens viewed, actions taken, referring information, error and diagnostic records, login or session events, and timestamps. Our web services may use cookies, local storage, or similar technologies needed for sign-in, preferences, security, and functionality.

Analytics and inferences. We may calculate or infer fan score, experience points, streaks, verified attendance, referrals, engagement, likely music interests, draw or turnout patterns, campaign results, venue or artist insights, weekly snapshots, abuse risk, and other performance or audience metrics. These outputs may be based on incomplete information and should be treated as estimates.

Information from others. We may receive information from another Ci user, an artist or venue team, a label, a promoter, a linked MobileFlow or Hytch account, Spotify, Stripe, Apple, a payment or email provider, a storage or hosting provider, or another partner involved in a feature you use.

3. HOW WE USE INFORMATION

We use personal information to:

create, authenticate, secure, and administer accounts;

provide profiles, shows, invitations, RSVPs, referrals, contact matching, attendance verification, media, chat, rewards, subscriptions, and SafeRide features;

connect fan, artist, promoter, venue, and label workflows;

personalize content and create music, attendance, engagement, fan, artist, venue, and campaign insights;

process transactions, confirm entitlements, administer rewards, prevent duplicate benefits, and maintain records;

send authentication, service, safety, invitation, support, payment, and optional marketing communications;

diagnose errors, support users, maintain availability, and develop or improve Ci;

detect, investigate, and prevent fraud, manipulation, abuse, security incidents, and violations;

moderate content, respond to reports, enforce agreements, and protect users, MobileFlow, and the public;

comply with law, legal process, accounting, tax, audit, and regulatory obligations; and

establish, exercise, or defend legal claims and complete a corporate transaction.

We may aggregate or de-identify information so it is not reasonably linked to an individual. We may use and disclose that information for lawful purposes and will not attempt to reidentify it except to test our de-identification methods or as permitted by law.

4. LEGAL BASES FOR EEA, UK, AND SWISS USERS

Where applicable law requires a legal basis, we rely on:

performance of a contract, to provide the account and features you request;

legitimate interests, such as securing, supporting, analyzing, and improving Ci, preventing fraud, and communicating about the Service, balanced against your rights;

consent, for optional permissions, connected accounts, or marketing where required; and

compliance with legal obligations and protection of vital interests, where applicable.

You may withdraw consent at any time, but withdrawal does not affect processing that was lawful before withdrawal. Some information is required to provide Ci; if you do not provide it, the relevant feature may not work.

5. HOW WE DISCLOSE INFORMATION

Other users and the public. We disclose information you make public, such as public artist profiles, handles, show information, setlists, and selected media. Invitations, referrals, guest lists, messages, and reactions are shared with the people involved in those features.

Artists, promoters, venues, and labels. Authorized professional users may receive show responses, verified attendance, referral, fan-engagement, and campaign information. Subject to fan visibility controls, they may also receive profile and home-city information. If you restrict sharing, we may provide pseudonymous, aggregate, or count-level data, including verified attendance totals.

Service providers. We disclose information to providers that help us host data, store media, deliver email and push notifications, process payments, geocode locations, monitor performance, provide support, and secure Ci. Depending on the feature, these may include providers such as Stripe, Apple, Expo, Google, Vercel, Resend or other email providers, and S3-compatible storage services. They may process information under their own terms when acting independently.

Connected services. At your direction, we exchange information with Spotify, Hytch, or another account you connect. Ci’s shared modern-api and Hytch infrastructure may receive account identifiers, reward, chat, and related information needed to operate cross-service features.

Business customers. If you use Ci through or in connection with an organization, we may disclose account and activity information to authorized administrators of that organization, consistent with role permissions.

Legal, safety, and enforcement. We may disclose information if we reasonably believe it is necessary to comply with law or valid legal process; investigate fraud or security incidents; enforce agreements; protect rights, property, or safety; or respond to an emergency involving danger of death or serious physical injury.

Corporate transactions. We may disclose information in connection with a merger, financing, acquisition, bankruptcy, reorganization, sale of assets, or due diligence, subject to appropriate safeguards.

With consent or direction. We disclose information for another purpose when you direct us or consent.

6. SALE, SHARING, AND TARGETED ADVERTISING

As of the Effective Date, MobileFlow does not sell personal information for money and does not share personal information for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws. We do not use third-party advertising SDKs in the current Ci applications reviewed for this Policy.

If our practices change, we will update this Policy and provide legally required choices, such as a “Do Not Sell or Share My Personal Information” mechanism. Disclosures to service providers, connected services you request, or professional users within Ci are not treated as sales when an applicable legal exception applies.

7. YOUR SETTINGS AND CHOICES

Account and profile. You may review or update certain account, role, profile, avatar, handle, city, and preference information through Ci.

Visibility controls. Fan settings may allow you to control whether hosts receive profile information and whether hosts receive location or home-city information. Restricting these settings may result in anonymized or reduced host-facing data, but verified attendance counts and records needed for integrity, security, or legal compliance may remain.

Location, camera, contacts, photos, and notifications. You can manage permissions in device settings. Ci will request permission before using protected device resources. Revoking a permission may disable the related feature but does not delete information already collected.

Spotify. You may disconnect Spotify in Ci or through Spotify account settings. You may also request deletion of previously imported Spotify data.

Marketing. You may use unsubscribe instructions or settings to stop optional marketing. We may continue to send non-marketing communications needed for your account, security, transactions, or legal notices.

Chat and safety. You may use available reporting and blocking controls. Blocking affects future interactions but may not erase messages already delivered, reported, or retained for safety and legal reasons.

Account deletion. You may use available in-app deletion controls or contact us. Deletion is subject to the limitations described in Section 9.

8. DATA RETENTION

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including providing Ci, maintaining account and transaction history, resolving disputes, enforcing agreements, preventing fraud, meeting legal obligations, and protecting users.

Retention depends on the type of information and context. For example:

active account, profile, and linked-account information generally remains while the account or connection is active;

show, invitation, referral, attendance, reward, and analytics records may remain to preserve historical reporting, integrity, fraud controls, and business records;

transaction and tax-related records may be retained for legally required accounting periods;

reports, blocks, moderation, and security records may remain as needed to protect users and prevent repeat abuse;

messages and shared content may remain until deleted under applicable controls, the room or account is deleted, or the relevant retention period ends;

backups may retain deleted information for a limited period before being overwritten; and

de-identified or aggregated information may be retained without the same limits if it cannot reasonably be linked to you.

When retention is no longer reasonably necessary, we delete, de-identify, or securely isolate information, subject to technical feasibility and legal requirements.

9. ACCOUNT DELETION AND SHARED RECORDS

Deleting a Ci account is designed to remove or de-identify account-owned records in active Ci systems. It may not remove every reference immediately. Some records are maintained with the user field removed, retained because another party has an independent record, held for payment or fraud prevention, or stored temporarily in backups.

Ci information processed in shared modern-api or Hytch infrastructure may follow a separate deletion workflow or retention cycle. We will coordinate a verified request across MobileFlow-controlled systems where applicable. Information copied by another user, posted publicly and republished, or held by an independent third party may remain outside our control.

10. SECURITY

We use administrative, technical, and organizational safeguards designed to protect personal information, such as access controls, credential hashing, token protection, secure device storage where supported, transport security, logging, and provider security features. The safeguards used depend on the sensitivity and context of the information.

No system is completely secure. Subscriber chat is not end-to-end encrypted, and anyone with authorized server-side access for the purposes described in this Policy may be technically capable of accessing message content. You are responsible for using a strong, unique credential, protecting your device, and promptly reporting suspected compromise.

11. INTERNATIONAL DATA TRANSFERS

MobileFlow and its providers may process information in the United States and other countries where privacy laws may differ from those where you live. Where required, we use an approved transfer mechanism or other legally recognized safeguard. You may contact us for more information about applicable safeguards.

12. U.S. STATE PRIVACY RIGHTS

Depending on where you live and whether the applicable law covers MobileFlow or the particular processing, you may have rights to:

confirm whether we process your personal information and access it;

correct inaccuracies;

delete personal information;

obtain a portable copy of certain information;

opt out of sale, targeted advertising, or certain profiling;

limit certain uses or disclosures of sensitive personal information; and

appeal a decision on your request.

We will not discriminate against you for exercising an applicable privacy right. To submit a request, email holt@celebintel.com with the subject “Ci Privacy Request” and describe the right you wish to exercise. We will verify your identity by matching information associated with your account or requesting additional information. An authorized agent may submit a request where permitted, but we may require proof of authority and identity verification.

We may deny or limit a request when an exception applies, such as protecting security, preventing fraud, preserving another person’s rights, completing a transaction, or complying with law. If we deny an appealable request, our response will explain how to appeal.

California notice at collection. The categories we may collect are identifiers; customer-record and account information; commercial and transaction information; internet or electronic activity; approximate or precise geolocation; audio, electronic, visual, or similar content; professional or employment-related information; inferences; and sensitive personal information such as account credentials, precise geolocation, message contents not directed to MobileFlow, and payment-related data. We collect and use these categories for the purposes in Section 3, retain them under Section 8, and disclose them to the categories of recipients in Section 5. We do not use or disclose sensitive personal information to infer characteristics about you outside purposes permitted without a right to limit under California law.

13. EEA, UK, AND SWISS PRIVACY RIGHTS

Where applicable, you may request access, correction, erasure, restriction, or portability; object to processing based on legitimate interests or direct marketing; withdraw consent; and lodge a complaint with your local data-protection authority. You may also have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Ci’s scores, estimates, and recommendations support engagement and operational decisions. MobileFlow does not intend them to make solely automated decisions that produce legal or similarly significant effects about ordinary consumer users. Contact us if you believe a feature has significantly affected you and you want human review.

MobileFlow Inc. is the controller for processing covered by this Policy unless we state that we act as a processor for a business customer.

14. CHILDREN

Ci is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided personal information, contact us. We will investigate and delete the information where required.

Parents and guardians should not permit a child to use an adult’s account. Age restrictions imposed by a venue, event, connected service, or payment platform still apply.

15. THIRD-PARTY LINKS AND SERVICES

Ci may link to or integrate third-party services. Their privacy policies govern their independent collection and use. Review those policies before connecting an account or providing information. MobileFlow is not responsible for the privacy or security practices of an independent third party.

16. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in Ci, law, or our practices. We will post the updated version and revise the Effective Date. If a change materially affects your rights, we will provide additional notice or seek consent when required.

17. CONTACT US

For questions, requests, or complaints about this Privacy Policy or MobileFlow’s Ci privacy practices, contact:

MobileFlow Inc.

Email: holt@celebintel.com

If applicable law gives you the right to complain to a regulator, you may contact the privacy or data-protection authority where you live.