Privacy Policy

Last Updated: September 29, 2026

Inkitt GmbH and Inkitt, Inc., together with their respective affiliates and subsidiaries (collectively, “Galatea,” “we,” “us,” or “our”) have created this privacy policy (this “Privacy Policy”) because we know that you care about how information you provide to us is used and shared. This Privacy Policy relates to our information collection and use practices in connection with our website located at https://galatea.com/ (the “Website”), and our reading app that is provided as a web-based application and/or mobile application which is accessible through tablets, smart phones, and other devices (“App”), and when you interact with us in any other way.

In this Privacy Policy, “personal data” refers to any information relating to an identified or identifiable natural person, as defined under the General Data Protection Regulation (“GDPR”) and other applicable data protection and privacy laws. In this Privacy Policy, the terms “personal data,” “personal information,” and “your information” may be used interchangeably to refer to the same concept, unless otherwise specified.

By visiting our Website, by clicking “I ACCEPT,” or otherwise manifesting your assent to the Privacy Policy and accompanying Terms of Service, when you download the App, sign up to access the App, and use the App, you acknowledge that you have read and understood this Privacy Policy and the accompanying Terms of Service.

Capitalized terms not defined in this Privacy Policy shall have the meaning set forth in our Terms of Service.

Controller Information

Inkitt GmbH, Saarbrücker Str. 36, 10405 Berlin, Germany and Inkitt, Inc., 500 3rd St, Room 245, San Francisco, CA 94107, USA, act as the joint controllers of your personal data within the meaning of the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR.

Inkitt, Inc. is a wholly-owned California subsidiary of Inkitt GmbH. Inkitt, Inc. provides services to residents of the European Economic Area and the United Kingdom (“UK”) and processes personal data subject to the GDPR and UK GDPR. For residents of California and other U.S. states, Inkitt, Inc. is the “business” responsible for compliance with the applicable U.S. state privacy laws, including the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”), for personal information processed in connection with our U.S. operations.

Inkitt GmbH and Inkitt, Inc. may share personal information between group companies and service providers to operate the Website and App as described in this Privacy Policy. Where required by applicable law, we implement appropriate safeguards and allocate responsibilities accordingly.

Inkitt, Inc. meets the applicability thresholds under certain U.S. state privacy laws, including the CCPA. Additional disclosures and rights information for residents of certain U.S. states are provided in the notices referenced below.

Inkitt GmbH and Inkitt, Inc. have allocated responsibilities for GDPR and UK GDPR compliance. If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at privacy@inkitt.com.

Our appointed Data Protection Officer (“DPO”) is Fresh Compliance GmbH and can be reached at: dsb@freshcompliance.de. Our DPO oversees GDPR and UK GDPR compliance across both entities.

I. The Information We Collect and/or Receive

In the course of operating the Website, the App, and/or interacting with you, we will collect (and/or receive) the following types of information. You authorize us to collect and/or receive such information.

Contact Information

When you contact us via email or in any other manner, or when you call us, you will be asked to provide your certain information, such as your name, email address, and information regarding your inquiry or request (collectively, the “Contact Information”). The Contact Information is used to provide the requested service or information and to contact you for purposes of direct marketing of our current and future products and services.

Account Information

If you would like to use the mobile App, you will need to download the mobile App from Apple, Google or any other app store through which the mobile App is made available to you. By downloading the App you acknowledge that you have read our Privacy Policy and Terms of Service.

You can access some parts of the App without creating an account. However, if you would like to access and use additional features and functionality of the App, you will have to create an account by providing your email address and creating a password. By using our Website or App (whether or not you create an account), you are authorizing Galatea to collect, store, and use, in accordance with this Privacy Policy, any and all information that you have authorized Google or Apple to provide to Galatea. Such information may include your first and last name, e-mail address, profile image, language, Google ID and Apple ID. All information that we collect and/or receive under this section is collectively referred to herein as “Account Information.” We use Account Information to process the creation of your Account, including verifying your identity and managing your account.

Profile Information

You may voluntarily provide additional information to create a profile associated with your account. Such information may include but shall not be limited to, name, date of birth, location, interests, and any other information you choose to share to complete your profile (collectively, the “Profile Information”).

Billing Information

In order to purchase a subscription to our App via our Website or App, or make any other purchases within the App, you will be required to provide certain additional information which may include a credit card number, expiration date, address and/or billing zip code, activation code, payment provider account and/or access information, and similar information (“Billing Information”). Such Billing Information will be collected and processed by our third-party payment processor pursuant to the terms and conditions of their privacy policies and terms of use. We do not directly obtain, store or process any Billing Information.

Information obtained automatically from your online activity

When you access or use the Website, and/or the App, we use browser cookies, pixels, web server logs, web beacons, and similar technologies (collectively, “Tracking Technologies”) to automatically collect or receive certain standard technical information and other data (such as traffic data, usage data (including but not limited to, profiles viewed, matches made, features used, frequency and duration of Website or App usage, and interactions with content on the Website or App), location data, device information (including but not limited to, type of device, mobile device platform, operating system, browser type, screen resolution, IP address and other technical information), logs and other communications data) sent to us by your computer, mobile device, tablet, or any other device over time on our Website or App, and your online activity across third party websites, apps, and devices. We may also evaluate your computer, mobile phone, or other access device to identify any malicious software or activity that may affect the availability of our Website or App.

When you access or use the Website or App, analytics networks and providers, and other third parties may use Tracking Technologies to collect information about your online activities over time and across different websites, apps, online services, digital properties and devices.

The data we or third parties collect automatically may include personal information and/or statistical data that may not identify you personally; however, we or third parties may maintain, combine, or associate it with personal information collected in other ways or received from third parties. We and/or third parties use this information to (i) enhance the performance and functionality of our Website or App; (ii) personalize your experience with the Website or App, understand how you use our Website or App, maintain a persistent session, and improve and further develop our Website or App; and (iii) provide custom experiences, across other sites, apps, online services, digital properties and devices, and for analytics purposes.

The Tracking Technologies used on the Website and the App include the following, among others:

Cookies: Cookies are small packets of data that a website stores on your computer’s hard drive so that your computer will “remember” information about your visit. In addition to collecting information, we use cookies to help us authenticate users, provide content of interest to you, analyze which features you use most frequently, and measure and optimize advertising and promotional effectiveness. To do this, we may use both session cookies, which expire once you close your web browser, and persistent cookies, which stay on your computer until you delete them. For information about your choices regarding Cookies, including managing your cookie preferences via the consent banner, please see Section IV of this Privacy Policy.

Local Storage Technologies: We may use local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data on your device outside of your browser in connection with specific applications.

Web Beacons: We use Web beacons, also known as pixel tags or clear GIFs, to demonstrate that a webpage or email address was accessed or opened, or that certain content was viewed or clicked.

Third Party Sites: When access to the Website or App is made available to you through third-party sites, such as social media, please be aware that these other sites maintain their own policies regarding Tracking Technologies and the collection and use of information. You are responsible for reviewing those policies.

Information obtained from third-party analytics services

We may use one or more third-party analytics services to evaluate your use of the Website or the App, compile reports on activity (based on their collection of IP addresses, Internet service provider, browser type, operating system and language, referring and exit pages and URLs, data and time, amount of time spent on particular pages, what sections of the Website or App you visit, number of links clicked while on the Website or App, search terms and other similar usage data), send you notifications, and analyze performance metrics. These third parties use cookies and other technologies to help analyze and provide us the data. By accessing and using any of the Website and/or App, you consent to the processing of data about you by these analytics providers in the manner and for the purposes set out in this Privacy Policy. Please be advised that if you opt out of any service, you may not be able to use the full functionality of the Website and the App. Below is a list of analytics providers that we use; however, such list may be subject to change based on how we wish to understand the user experience and we will endeavor to update it diligently. You may use the accompanying links to learn more about such providers and, if available, how to opt out of their analytics collection.

For more information on services affiliated with Google (including but not limited to AdMob, Google Analytics, and Firebase), including how to opt out of certain data collection and privacy requests, please visit https://policies.google.com/privacy.

For more information about Google Analytics, please visit https://www.google.com/analytics

For more information on Google Firebase, including privacy requests, please visit https://firebase.google.com/support/privacy

For more information on Iterable, including privacy requests, please visit https://iterable.com/legal/privacy-policy/

For more information on Sendgrid, including privacy requests, please visit https://www.twilio.com/legal/privacy

For more information on RevenueCat, including privacy requests, please visit https://www.revenuecat.com/privacy/

For more information on FunnelFox, including privacy requests, please visit https://adapty.io/privacy/

For more information on Meta, including how to opt out of certain data collection, please visit https://www.facebook.com/privacy/policy/

For more information on Taboola, including privacy requests, please visit https://www.taboola.com/policies/privacy-policy

For more information on Podscribe, including privacy requests, please visit https://podscribe.com/privacy

For more information on AppLovin' / axon.ai, including privacy requests, please visit https://legal.applovin.com/privacy/

For more information on Branch, including privacy requests, please visit https://legal.branch.io/#branchio-privacypolicy

For more information on Adjust, including privacy requests, please visit https://www.adjust.com/terms/privacy-policy

Information Collected by or Through Third-Party Advertising Companies

We may share information about you with third parties that we have selected and approved for ad distribution and ad optimization (defined as the tailoring, targeting (i.e., behavioral, contextual, and retargeting), analyzing, managing, reporting, and optimizing of ads). These third parties may use cookies, pixel tags (also called web beacons or clear gifs), and/or other technologies to collect Other Information for such purposes. Pixel tags enable us and these third-party advertising companies to recognize a browser’s cookie when a browser visits the site on which the pixel tag is located in order to learn which advertisement brings a user to a given site. In addition, we may receive information from advertisers and/or their service providers such as advertising identifiers, IP addresses, and post-conversion data. You may choose to opt out of this type of tracking and sharing of information at any time by selecting the specific partners you wish to exclude from this website http://www.aboutads.info/choices. You can also limit this type of tracking through the Do Not Track functionality in your web browser and a “Limit Ad Tracking” setting on iOS devices or a setting to “Opt out of Interest-Based Ads” on Android.

Automated decision making (including profiling)

We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (within the meaning of Art. 22 GDPR). If this changes, we will update this Privacy Policy and provide appropriate notice.

Information obtained from Other Sources

Social Media: We maintain a presence on Facebook, Instagram, TikTok, and other social media and third-party sites, including our accounts, pages and related activities. We may collect personal information when you visit or use social media, including when you access our Website or App from social media. We will do so in accordance with the terms of use and privacy policies of those sites, apps and applicable law. These sites may provide aggregate information and analysis to us about visitors’ use of our social media pages. This allows us to better understand and analyze our user growth, general demographic information about the users of these pages, and interaction with the content that we post. Overall, this information may be used to help us understand the types of visitors and users of our social media pages and use of the content. This Privacy Policy does not cover personal information collected by such third-party social media sites. For more information on their privacy and security practices please review the privacy policies and terms of use on their respective website.

II. Our Legal Basis For Processing Your Information Under GDPR And UK GDPR

We rely upon the appropriate legal bases under the applicable privacy law for processing personal information. Under the GDPR and UK GDPR, both Inkitt GmbH and Inkitt, Inc., as joint controllers, process personal information where this is necessary for the fulfilment of a contract, where the processing is necessary to carry out our legal obligations, where you have given us your consent, or where it is in our legitimate interests to do so.

The following table sets forth the legal basis we rely on for each category of personal data and processing purpose:

We collect information that you voluntarily provide to us or that is provided to us on your behalf. If you do not provide us with information we need, we may be unable to offer our Website or App.

III. How We Use and Share Your Information

In addition to the uses of information described elsewhere in this Privacy Policy, we may also use and share your personal information as set forth below:

• To provide the Website and the App and customize the content you see on the Website and the App;
• To solicit your feedback, inform you about our products and services and those of our third-party marketing partners;
• To monitor, support, analyze, and improve the Website and the App;
• To communicate with you regarding the Website and the App;
• To fulfill your requests for information regarding new or improved products and services;
• To engage in marketing, advertising, and tracking activities, and evaluate the efficacy of our efforts, provided that, where required under applicable law, we will obtain your prior opt-in consent to send electronic marketing communications and/or our newsletter;
• To engage in research, project planning, troubleshooting problems, and detecting and protecting against error, fraud, or other criminal activity;
• To protect the safety and security of our Website and App, businesses and customers;
• To third-party contractors and service providers that provide services to us in the operation of our business and assistance with the Website and App, such as technical support for our Website and App and providing services such as marketing and advertising companies, consulting service organizations, IT and cloud service providers, payment processors, among others;
• To create and disclose aggregated, anonymous, user statistics and other information to (i) affiliates, agents, business partners, and other third parties; (ii) describe the Website and App to current and prospective business partners; and (iii) other third parties for lawful purposes;
• To share some or all of your information with our parent company, subsidiaries, affiliates or other companies under common control with us;
• To fulfill our legal and regulatory requirements;
• To comply with applicable law, such as to comply with a subpoena, or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• To assess or complete a corporate sale, merger, reorganization, sale of assets, dissolution, investment, or similar corporate event where we expect that your personal information will be part of the transferred assets;
• To audit our internal processes for compliance with legal and contractual requirements or our internal policies;
• To prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft; and
• Otherwise, with your consent.

In addition to the general uses and disclosures listed above, certain U.S. state privacy laws impose specific obligations regarding the "sale" or "sharing" of personal information. We do not "sell" your personal information in the traditional sense (i.e., we do not exchange your information for money). However, we may "share" personal information such as device and usage data with advertising or analytics partners to support interest-based advertising or cross-context behavioral advertising, as defined under applicable state laws. You can manage your choices regarding such sharing through our consent management platform accessible via the “Your Privacy Choices” link at the bottom of our Website.

IV. YOUR CHOICES

Update Information: If the personal information we have for you changes, you may correct, update, or delete it by contacting us as set forth in Section XVI of this Privacy Policy. You may correct, update, or delete some of their personal information directly in your account on the App. We will use commercially reasonable efforts to process all such requests in a timely manner. You should be aware, however, that it is not always possible to completely remove or modify information in our databases. Additionally, we will retain and use your information (or copies thereof) as necessary to comply with our legal and/or regulatory obligations, resolve disputes, and enforce our agreements.

Marketing Communications: You may manage your receipt of marketing and non-transactional communications by clicking on the “unsubscribe” link located at the bottom of any of our marketing emails. Please note that you cannot opt out of receiving transactional e-mails.

Cookie Management:

• Browser Settings: Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies or other Tracking Technologies, the App may not work properly. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org.
• Cookie Consent Banners: You can manage your cookie preferences via the consent banner shown on our Website and App. Non-essential cookies and tracking technologies are not deployed until you provide affirmative consent through the consent banner. You may withdraw your consent at any time with effect for the future by adjusting your cookie preferences through the same consent mechanism (“Your Privacy Choices” in the footer of our Website); in the App, you can change your choices under Settings › “Your Privacy Choices”. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. We rely on your consent for setting cookies or processing personal data in accordance with applicable data protection laws. For cookies and similar technologies that are not strictly necessary for the technical operation of our Website and/or App (e.g., analytics, marketing or attribution cookies), we obtain your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) and process any resulting personal data on the basis of your consent. For strictly necessary cookies, we rely on our legitimate interests to process your personal data.
• Targeted Advertising Opt-Outs and Cookie Controls: You can exercise your right to opt out of the processing of your personal information for targeted advertising by adjusting your cookie settings. When you visit our Website or App, you will be prompted to make your selection via the consent banner displayed at the bottom of the screen. You can update your preferences at any time by clicking on “Your Privacy Choices” in the Website footer or under Settings in the App.
• Universal Opt-Out Mechanisms: If you are visiting our Website or App using a web browser with the Global Privacy Control ("GPC") signal enabled, we will treat the GPC signal as a request to opt out of targeted advertising and "sales."

• You will need to apply these opt-out settings on each device from which you wish to opt out. We cannot offer any assurances as to whether the companies we work with participate in the opt-out programs described above.

V. How We Protect the Information

We take commercially reasonable steps to protect your information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. Please understand, however, that no security system is impenetrable. We cannot guarantee the security of our databases or the databases of the third parties with which we may share such information, nor can we guarantee that the information you supply will not be intercepted while being transmitted over the Internet. In particular, e-mail sent to us may not be secure, and you should therefore take special care in deciding what information you send to us via e-mail.

VI. Data Retention

We retain your personal data only for as long as necessary and in accordance with applicable legal requirements. Specifically:

• When processing is based on your consent: until you withdraw consent.
• When processing is necessary for contractual purposes: until the end of the contractual relationship or the applicable statutory retention period, whichever is longer.
• When required to comply with legal obligations: for the duration of the applicable legal obligation. This includes statutory retention obligations under German tax and commercial law (Art. 6(1)(c) GDPR).
• When processing is based on our legitimate interests: until those interests are overridden by your rights or interests in deletion or anonymization.

In particular, account data is stored for as long as your account exists and is deleted after account deletion, except where we must keep it to meet the statutory retention obligations described below; invoice and transaction data are retained for the statutory retention periods under German tax and commercial law (currently 8 or 10 years, § 147 AO, § 257 HGB); and server logs are deleted after a short period. The storage periods of cookies are shown in our cookie settings.

VII. External Sites

The Website and the App may also contain hyperlinks to other third-party websites or apps (“External Websites”). We have no control over the privacy practices or the content of any of our business partners, advertisers, sponsors, or External Websites to which we provide hyperlinks. As such, we are not responsible for the content or the privacy policies of those External Websites. You should check the applicable third-party privacy policy and terms of use when visiting any External Websites.

VIII. Children’s Information

The Website and App are intended for users 18 years of age or older, and we do not knowingly collect personal information from individuals under 18. We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce our Privacy Policy by instructing their children never to provide personal information through the Website and the App without their permission. If you have reason to believe that a child under the age of 18 has provided personal information to us, please contact us, and we will endeavor to delete that information from our databases.

IX. International Data Transfer

We may transfer your personal data outside the European Economic Area or United Kingdom, including to the United States. Inkitt, Inc. is located in the United States and processes personal data of EEA and UK residents in connection with the services it provides. Where we transfer personal data to countries not deemed to provide an adequate level of protection by the European Commission or UK authorities, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission or UK authorities;
• Supplementary measures where required;
• For transfers to the United States, the European Commission’s adequacy decision of 10 July 2023 under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise the Standard Contractual Clauses (Art. 46(2)(c) GDPR); for transfers from the UK, the UK Addendum to the Standard Contractual Clauses.

For users in the EEA and UK, personal data may be transferred between Inkitt GmbH and Inkitt, Inc. as joint controllers. Such transfers are governed by Standard Contractual Clauses, and we implement supplementary technical and organizational measures as appropriate.

You may request a copy of applicable safeguards by contacting privacy@inkitt.com.

X. Your Data Protection Rights (EEA/UK Residents)

If you are located in the EEA or UK, you have certain rights with respect to your personal data, including those set forth below. For more information about these rights, or to submit a request, please email us at privacy@inkitt.com with the subject line “GDPR Request.”

You are not required to pay any charge for exercising your rights. If you make a request, we will respond within one month; this period may be extended by two further months where necessary (Art. 12(3) GDPR). Please note that in some circumstances, we may not be able to fully comply with your request, such as if it is manifestly unfounded or excessive (Art. 12(5) GDPR), if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include personal data, if necessary to verify your identity and the nature of your request.

• Right of access: You can request more information about the personal data we hold about you and request a copy of such personal data.
• Right to rectification: If you believe that any personal data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
• Right to erasure: You can request that we erase some or all of your personal data from our systems.
• Right to restriction of processing: You have the right to ask us to restrict the processing of your personal data.
• Right to object to processing: You have the right to object to the processing of your personal data in certain circumstances.
• Right to data portability: You can ask for a copy of your personal data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
• Right to withdraw consent: If we are processing your personal data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. The withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before the withdrawal.
• Objecting to Legitimate Interest/Direct Marketing: You may object to personal data processed pursuant to our legitimate interest. In such case, we will no longer process your personal data unless we can demonstrate appropriate, overriding legitimate grounds for the processing or if needed for the establishment, exercise, or defense of legal claims. You may also object at any time to processing of your personal data for direct marketing purposes by clicking “Unsubscribe” within an automated marketing email or by submitting your request to privacy@inkitt.com with the subject line “GDPR Request.” In such case, your personal data will no longer be used for that purpose.

We will respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. We reserve the right to keep any information in our archives that we deem necessary to comply with our legal obligations, resolve disputes and enforce our agreements. Please note that all of these rights are subject to applicable exemptions and restrictions, and are not absolute rights. If we need to rely on these exemptions or restrictions, we will provide this information to you in our response.

If you have any concerns about our use of your personal data, you can make a complaint to us at privacy@inkitt.com with the subject line “GDPR Request.” You also have the right to lodge a complaint about the processing of your personal data with a supervisory authority of the European state where you work or live or where any alleged infringement of data protection laws occurred. For complaints related to UK GDPR, you may also contact the UK Information Commissioner’s Office (ICO). A list of most of the supervisory authorities can be found here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

XI. Notice to California Residents

If you are a resident of California, you may have additional rights regarding your personal information under the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”). Please review our CCPA Privacy Notice.

XII. Notice to Nebraska Residents

If you are a resident of Nebraska, you may have additional rights regarding your personal information under the Nebraska Data Privacy Act (“NEDPA”). Please review our NEDPA Privacy Notice.

XIII. Notice to Nevada Residents

We do not sell your personal information as defined under Nevada law. Nonetheless, if you are a resident of Nevada, you have the right to opt out of the sale of certain personal information to third parties. You can exercise this right by contacting us at privacy@inkitt.com with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account.

XIV. Notice to Texas Residents

If you are a resident of Texas, you may have additional rights regarding your personal information under the Texas Data Privacy and Security Act (the “TDPSA”). Please review our TDPSA Privacy Notice.

XV. Changes to This Privacy Policy

This Privacy Policy is effective as of the date stated at the top of this Privacy Policy. We may change this Privacy Policy from time to time with or without notice to you. Any such changes will be posted on the Website and the App. By accessing and/or using the Website and/or the App after we make any such changes to this Privacy Policy, you are deemed to have accepted such changes. Please be aware that, to the extent permitted by applicable law, our use of your information is governed by the Privacy Policy in effect at the time we collect the Information. Please refer back to this Privacy Policy on a regular basis.

XVI. How to Contact Us

If you have any questions about this Privacy Policy or to report a privacy issue, please contact us in one of the following ways:

Email: privacy@inkitt.com

Or write to us at:

Inkitt GmbH

Saarbrücker Str. 36

10405 Berlin

Germany

Inkitt, Inc.

500 3rd St, Room 245, San Francisco, CA 94107, USA

CCPA Privacy Notice

Last Updated: September 29, 2026

The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”) grants residents of the State of California (“consumers”) and households located in California certain rights regarding their Personal Information. This CCPA Privacy Notice (the “CCPA Privacy Notice”) applies to the Personal Information of consumers and/or households that is collected and/or processed (online and/or offline) by or on behalf of Inkitt, Inc. in connection with U.S. operations and supplements our Privacy Policy. All capitalized terms herein have the meanings given in the CCPA, CPRA or the Privacy Policy. We address Personal Information associated with our employees and job applicants separately. In the event of any conflict between this CCPA Privacy Notice and terms in the Privacy Policy, the provision that is more protective of your Personal Information shall control to the extent of such conflict.

If you have any questions about this CCPA Privacy Notice or whether any of the following rights apply to you, please contact us at privacy@inkitt.com. If you are located outside of the State of California, this CCPA Privacy Notice does not apply to you and you should refer to our Privacy Policy.

I. The Personal Information We Collect, Why We Collect it, and How Long We Keep it

We may collect the categories of Personal Information listed in the tables below for the specific business purposes listed next to them.

Galatea determines the retention periods of each category of Personal Information based on the following criteria:

• The purposes for which Galatea processes the Personal Information (Galatea needs to retain the data as long as necessary to complete such purposes); and
• Tax, legal and regulatory obligations and requirements (laws or regulation may set, or recommend, a minimum period for retention of your Personal Information).

II. How We Obtain Your Personal Information

We receive your Personal Information directly from you, as well as from the following categories of sources:

• Internet or other electronic network activity;
• Third-party Advertisers/Remarketers;
• Third-party service providers;
• Third-party analytics services; and
• Social Media Platforms

III. What Kind of Personal Information We Disclose to Others

We may disclose the following categories of Personal Information to the following categories of service providers and/or contractors for a business purpose.

IV. Your Rights and Choices

The CCPA provides consumers and households with specific rights regarding their Personal Information. Galatea will usually be the business processing your Personal Information. If Galatea is acting as a service provider or contractor on behalf of another business, please contact the business that collected your Personal Information in the first instance to address your rights with respect to such data.

Right to Know About Your Personal Information

You have the right to request that we disclose the following kinds of information to you about our collection, disclosure, sale, sharing, and use of your Personal Information:

• Categories of Personal Information, sources, business or commercial purposes, and to whom the information was disclosed. Please see for this information Sections I-III of this CCPA Privacy Notice.
• Specific Pieces of Personal Information: If you would like to know and access the specific pieces of Personal Information that we have collected about you, please contact us as described in Section IX below. You may exercise this right up to two times in any 12-month period.
• Categories of Personal Information Sold: We do not sell your Personal Information in the traditional sense (i.e., we do not exchange your Personal Information for money). However, we may “share” Personal Information – such as device and usage data – with advertising or analytics partners to support interest-based advertising or cross-context behavioral advertising, as defined under the CPRA. You can manage your choices regarding such sharing as set forth in this CCPA Privacy Notice.
• Categories of Personal Information Shared: The categories of Personal Information shared for the purpose of cross-context behavioral advertising in the last twelve months are: Identifiers, and internet or other electronic network activity information.

Right to Request Deletion

You have the right to request deletion of your Personal Information. We will honor such request but might not be able to fulfill your request if we (or our service providers) are required to retain your Personal Information. Examples of such exceptions are:

• Completing a transaction or performing a contract we have with you;
• Detecting and addressing data security incidents, and repairing or upkeep of our IT systems;
• Protecting against fraud or other illegal activity;
• Complying with applicable law or a legal obligation, or to exercise rights under the law (e.g., the right to free speech); or
• Using your Personal Information internally to improve our Website, Products, Digital Content and Services.

Right to Request Correction

You have the right to request that we correct inaccurate Personal Information that we maintain about you. We will honor such request but might not be able to fulfill your request if it is impossible to do so or would involve disproportionate effort, or if we have a good-faith, reasonable, and documented belief that a request to correct is fraudulent or abusive.

Right to Opt-Out of the Sale and/or Sharing of Personal Information

You have the right to opt-out of the sale and/or sharing of your Personal Information. Please exercise your rights as set forth in Section V below.

Right to Limit the Use and Disclosure of Sensitive Personal Information

You have the right to limit certain ways in which a business uses and discloses sensitive Personal Information. Please note, however, that we only collect the information mentioned in this CCPA Privacy Notice, and do not use or disclose it for any purposes that are covered by this right (nor have we done so in the past).

Right to Designate an Authorized Agent

You have the right to submit a request through the use of an authorized agent. If you choose to do so, we may require that you (i) provide the authorized agent written permission to act on your behalf, and (ii) verify their identity directly with us. We may deny a request from an authorized agent that does not submit proof of authorization.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not (i) deny you products or services, (ii) charge you different prices or rates for products or services, including through granting discounts or other benefits, or imposing penalties (except for financial incentives permitted by the CCPA, see below), (iii) provide you a different level or quality of products or services, and (iv) suggest that you may receive a different price or rate for products or services or a different level or quality of products or services.

V. Exercising Your Privacy Rights

a) Rights to Know, to Request Deletion, and to Request Correction of Personal Information

To exercise these rights, please submit a verifiable consumer request to us entitled “California Privacy Request,” by using the following methods:

• Email us at: privacy@inkitt.com; or

What we need to know to fulfill your request

The verifiable consumer request must: (i) provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative; and (ii) describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information related to you. Making a verifiable consumer request does not require you to create an account with us.

How you will hear back from us

We will confirm receipt of a verifiable consumer request within ten (10) business days of its receipt. We will endeavor to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we require more time, we will notify you of the extension and provide an explanation of the reason for the extension in writing, and we will provide you with a response no later than ninety (90) calendar days of receipt of the request. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We may charge a reasonable fee to process or respond to your verifiable consumer requests if they are excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will inform you of the reasons for this decision and provide you with a cost estimate before completing your request.

b) Right to Opt-Out of the Sale and/or Sharing of Personal Information

We have implemented technology for the purpose of honoring certain technologies broadcasting an Opt-Out Preference Signal such as the Global Privacy Control (“GPC”). This occurs on the browsers and/or browser extensions that support such a signal. This request will be linked to your browser identifier only and will not tie to your individual identity. We will process your opt-out preference using the GPC in a frictionless manner. This means that (1) we will not charge a fee or require any additional consideration if you use an opt-out signal, (2) your experience with our services will not change after processing of the opt-out signal, and (3) no additional notifications, pop-ups, text, or graphics will appear in response to the opt-out signal.

Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the websites you visit indicating you do not wish to be tracked. Unlike the GPC described above, there is not a generally accepted understanding of how to interpret DNT signals. However, we have implemented technology to attempt to honor such DNT signals to the best of our ability.

You do not need to create an account with us to exercise your opt-out rights. We will only use Personal Information provided in an opt-out request to review and comply with the request.

VI. Notice of Financial Incentives

On our Website and App, users may sign up to receive our newsletters. In return for your email address, we may offer you certain financial incentives such as a one-time discount off your full price subscription to the App or on the Website. These financial incentives are reasonably related to the value of the Personal Information you provide. We calculate the value of our offers and financial incentives based on the expenses related to offering these benefits to participants. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

VII. Other California Privacy Rights

Pursuant to Section 1798.83 of the California Civil Code, residents of California have the right to obtain certain information about the types of Personal Information that companies with whom they have an established business relationship (and that are not otherwise exempt) have shared with third parties for direct marketing purposes during the preceding calendar year, including the names and addresses of those third parties, and examples of the types of services or products marketed by those third parties. In order to submit such a request, please contact us at privacy@inkitt.com.

VIII. Changes to this CCPA Privacy Notice

This CCPA Privacy Notice is effective as of the date of the Last Update stated at the top of this CCPA Privacy Notice. We may change this CCPA Privacy Notice from time to time with or without notice to you. By visiting or accessing the Websites or the Services, or otherwise engaging or interacting with us after we make any such changes to this CCPA Privacy Notice, you are deemed to have accepted such changes. Please be aware that, to the extent permitted by applicable law, and without prejudice to the foregoing, our use of your Personal Information is governed by the CCPA Privacy Notice in current effect. Please refer back to this CCPA Privacy Notice on a regular basis.

IX. How to Contact Us

If you have any questions or comments about this CCPA Privacy Notice, the ways in which we collect and use your information, or your choices and rights regarding such use, please do not hesitate to contact us at: privacy@inkitt.com.

Nebraska Data Privacy Act Notice

Last Updated: September 29, 2026

This Nebraska Data Privacy Act (“NEDPA”) Notice (“Notice”) provides additional information to Nebraska residents whose personal information is collected by us pursuant to Nebraska Law. If you are not a Nebraska resident, this Notice does not apply to you. This Notice applies to Nebraska residents who are acting only in an individual or household context. This Notice is provided to you to inform you of, among other things, how we collect, use, and share your Personal Data, that we may collect from your or that you may provide to us through (i) our Website or (ii) our App, and the rights you have with respect to your Personal Data. Capitalized terms not defined here or in our Privacy Policy have their meaning set forth in NEDPA.

The list below sets forth the categories of Personal Data we have collected from consumers within the last twelve (12) months, which is based on those sources listed in the Information Which We Collect and/or Receive section of our Privacy Policy. We Process Personal Data for those purposes set forth in the How We Use and Share the Information section of our Privacy Policy:

• IDENTIFIERS, including a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.
• CUSTOMER RECORDS PERSONAL INFORMATION CATEGORIES, including name, address, telephone number
• PROTECTED CLASSIFICATION CHARACTERISTICS UNDER TEXAS OR FEDERAL LAW, including Age (40 years or older) (only when voluntarily disclosed by users)
• INTERNET OR OTHER SIMILAR NETWORK ACTIVITY, including information on a consumer's interaction with our Website and App

We may share your Personal Data by disclosing it to a third-party for business or commercial purposes. We only make these business or commercial purpose disclosures under written contracts that describe the purposes, require the recipient to keep the Personal Data confidential, and prohibit the recipient from using the disclosed information for any purpose except performing under the contract. For more information on the circumstance in which we may disclose your Personal Information, including Personal Data, please refer to the Disclosure of Information section of our Privacy Policy. In the preceding twelve (12) months, we have disclosed the following categories of Personal Data for business or commercial purposes to the following categories of third-parties:

We do not use or disclose your sensitive personal information for any other purpose other than to perform business services, including providing our products and services to you. Your information is used in accordance with this Notice and our Privacy Policy.

YOUR RIGHTS AND CHOICES

The NEDPA provides consumers (Nebraska residents) with specific rights regarding their personal information. This section describes your NEDPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection of your personal information. Once we receive and confirm your verifiable consumer request (see Exercising Your Rights), we will disclose to you whether we are processing your personal information, and if so, what categories of personal information we collected and have processed about you. We will also provide, upon request, the specific pieces of personal information we collected about you (also called a data portability request).

Deletion Request Rights

You have the right to request that We delete any of your personal information that it collected from you or obtained regarding you. Once we receive and confirm your verifiable consumer request (see Exercising Your Rights), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

Correction of Inaccurate Personal Data Rights

You may update or correct your personal information. We may ask that you identify yourself and the information you wish to change for security purposes.

Exercising Your Right

Only you or an authorized agent may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 days) to respond to a verifiable consumer request to access, delete or correct, we will inform you of the reason and extension period in writing within the initial forty-five (45) days after receipt of the verifiable consumer request.

If you have an account with us, our written response to your verifiable consumer request will be delivered through such account. If you do not have an account with us, we will deliver our written response electronically. For data portability requests, we will select a format that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

If applicable, our response will explain the reasons we cannot comply with your request.

We do not charge a fee to process or respond to your verifiable consumer request, up to two requests within a twelve (12) month period, unless such request is excessive, repetitive, or manifestly unfounded.

If we determine that the request warrants a fee, we will inform you of the reasons for such decision and provide you with a cost estimate before completing your request. Appeal

If we have denied a consumer request submitted by you in accordance herewith, you can file an appeal with us by contacting us by email at privacy@inkitt.com. We will respond to you in writing within 60 days of receipt of your appeal, explaining the reasons for our decision.

If we deny your appeal, you can contact the state Attorney General at:

Office of Attorney General 2115 State Capitol

Lincoln, NE 68509

https://ago.nebraska.gov/consumer-protection

Opt-Out of Processing of Personal Information for Targeted Advertising

You have the right to direct us not to share your personal information for targeted advertising at any time. We do not share personal information of consumers we have actual knowledge are less than 18 years old for targeted advertising.

To exercise the right to opt-out, you (or your authorized representative) may submit a request to us at privacy@inkitt.com or by using “Your Privacy Choices” in the footer of our Website

You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.

Non-Discrimination

We will not discriminate against you for exercising any of your NEDPA rights. Unless permitted by NEDPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you with a different level or quality of goods or services; or
• Retaliate against you for exercising your NEDPA rights.

Changes to Our Nebraska Data Privacy Act Notice

We reserve the right to amend this privacy notice at its discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Site and update the notice’s effective date.

Contact Information

CONTACT US; SUBMIT A REQUEST: If you have any questions, comments, or concerns about this NEDPA Notice, the ways in which we collect and uses the information described herein or in our Privacy Policy, your choices and rights regarding such use, or if you wish to exercise your rights under the NEDPA, please do not hesitate to contact us at one of the following methods:

Texas Data Privacy and Security Act Notice

Last Updated: September 29, 2026

This Texas Data Privacy and Security Act Notice (“Notice”) provides additional information to Texas residents whose personal information is collected by us pursuant to Texas law, including the Texas Data Privacy and Security Act (“TDPSA”). If you are not a Texas resident, this Notice does not apply to you. This Notice applies to Texas residents who are acting only in an individual or household context. This Notice is provided to you to inform you of, among other things, how we, in our capacity as a “Controller”, collect, use, and share your Personal Data, that we may collect from your or that you may provide to us through (i) our Website or (ii) our App, and the rights you have with respect to your Personal Data. Capitalized terms not defined here or in our Privacy Policy have their meaning set forth in TDPSA.

The list below sets forth the categories of Personal Data we have collected from consumers within the last twelve (12) months, which is based on those sources listed in the Information Which We Collect and/or Receive section of our Privacy Policy. We Process Personal Data for those purposes set forth in the How We Use and Share the Information section of our Privacy Policy:

• IDENTIFIERS, including A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.
• CUSTOMER RECORDS PERSONAL INFORMATION CATEGORIES, including name, address, telephone number
• PROTECTED CLASSIFICATION CHARACTERISTICS UNDER TEXAS OR FEDERAL LAW, including Age (40 years or older) (only when voluntarily disclosed by users)
• INTERNET OR OTHER SIMILAR NETWORK ACTIVITY, including information on a consumer's interaction with our Website and App

We may share your Personal Data by disclosing it to a third-party for business or commercial purposes. We only make these business or commercial purpose disclosures under written contracts that describe the purposes, require the recipient to keep the Personal Data confidential, and prohibit the recipient from using the disclosed information for any purpose except performing under the contract. For more information on the circumstance in which we may disclose your Personal Information, including Personal Data, please refer to the Disclosure of Information section of our Privacy Policy. In the preceding twelve (12) months, we have disclosed the following categories of Personal Data for business or commercial purposes to the following categories of third-parties:

YOUR RIGHTS AND CHOICES

The TDPSA provides you with specific rights regarding your Personal Data. This section describes your rights under the TDPSA and explains how you can exercise those rights.

Right to Access Information/Correct Inaccurate Personal Data You have the right to request access to Personal Data collected about you and information regarding the purposes for which we collect it and the third parties and service providers with which we share it. In addition, you have the right to correct inaccurate or incomplete Personal Data. To make a request to correct inaccurate or incomplete Personal Data, please submit your request to us at any method set forth in Contact Us; Submit A Request, below.

Right to Obtain a Copy of Personal Data You have the right to request a copy of the Personal Data that you previously provided to us in a portable format (a “Data Portability Request”), once within a twelve (12) month period. For each Data Portability Request, we will select a format to provide your Personal Data that should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your Data Portability Request, unless it is excessive, repetitive, or manifestly unfounded. If we determine that the Data Portability Request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your Data Portability Request. In order to process your Data Portability Request, we must be able to verify your identity or authority to make the Data Portability Request and confirm the Personal Data relates to you. For more information regarding verification of your identity, please see Verification of Identity and Processing of Requests, below. To make a Data Portability Request, please submit your request to us at any method set forth in Contact Us; Submit A Request, below.

Right to Delete Personal Data You have the right to request that we delete any Personal Data that we have collected directly from you or from a third-party, subject to certain exceptions. Once we receive and verify your identity, we will delete (and direct our service providers to delete) your Personal Data from our records in accordance with your request, unless an exception applies. We may deny your deletion request or not delete some of your Personal Data, if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the Personal Data, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

• Debug products to identify and repair errors that impair existing intended functionality.

• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

• Comply with a legal obligation.

• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We may also limit deletion to the extent permitted by applicable law. For more information regarding verification of your identity, please see Verification of Identity and Processing of Requests, below. To make a deletion request, please submit your request to any method set forth in Contact Us; Submit A Request, below.

Response to Your Request: Timing and Format We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact privacy@inkitt.com. We will attempt to respond to a verifiable consumer request within forty-five (45) days of receiving that request. If we require more time, we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the twelve (12) month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For Data Portability Requests, we will select a format to provide your Personal Data that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is a second or repetitive request within a twelve (12) month period. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Right to Appeal Denial of Request Regarding Your Personal Data

If we decline your request, in connection with your rights set forth in this Notice, you have the right to appeal such decision by submitting your appeal request to at any method set forth in Contact Us; Submit A Request, below. We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact privacy@inkitt.com.

We will attempt to resolve your appeal request within forty-five (45) days of receiving your appeal request. If we require more time, we will inform you of the reason and extension period in writing. We will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decision.

If we deny your appeal request, you have the right to File a Complaint with the Attorney General of Texas. To learn more about how you can File a Complaint with the Attorney General of Texas please visit File a Complaint. Do note that the information provided at these links is third party information, and as such, we are not responsible for the completeness or accuracy of such information.

Right to Opt Out You have the right to OPT OUT of our processing your Personal Data for the purposes of: (i) Targeted Advertising or (ii) Sale of Personal Data. To exercise the right to OPT OUT, you (or your authorized representative) must submit a request to us at any of the methods set forth in Contact Us; Submit A Request, below.

Non-Discrimination We will not discriminate against you for exercising any of your rights under the TDPSA. Unless permitted by the TDPSA, we will not:

• Deny you goods or services.
• Increase the cost for goods or services.
• Provide a different level of quality.

VERIFICATION OF IDENTITY AND PROCESSING OF REQUESTS: To protect Texas consumers’ Personal Data and to comply with the TDPSA, as required or permitted under applicable law, we may take steps to verify your identity before processing any request set forth in Your Rights and Choices, above, before we act on your request. In order for your request to be processed, you must provide us with enough information to reasonably verify you are the Texas consumer about whom we collected Personal Data or an authorized representative of that Texas consumer. If you use an authorized agent to submit a request on your behalf, we may require that you (i) provide the authorized agent written permission to do so, and (ii) provide us either a copy of that written authorization or a copy of the power of attorney for the authorized agent to act on your behalf.

In verifying requests, we employ reasonable measures to detect fraudulent requests and prevent unauthorized access to your Personal Data. To meet our obligations under the TDPSA, we are required to authenticate your identity and the identity of your authorized representative. You do not need to create an account with us to submit a request. However, we do consider requests made through your password protected account sufficiently verified when the request relates to Personal Data associated with that specific account.

We will confirm receipt of your request within ten (10) business days and provide information about how we process your request. We will attempt to respond to a verifiable request within forty-five (45) days of receiving that request. If we require more time, we will inform you of the reason and extension period in writing.

CONTACT US; SUBMIT A REQUEST: If you have any questions, comments, or concerns about this TDPSA Notice, the ways in which we collect and use the information described herein or in our Privacy Policy, your choices and rights regarding such use, or if you wish to exercise your rights under the TDPSA, please do not hesitate to contact us at one of the following methods: