CONSUMER PRIVACY POLICY

1. Introduction and Scope

1.1 Controller. REPORT A SCAM LLC, a Wyoming limited liability company, with an address at 5830 E 2nd St Ste 7000, Casper, Wyoming 82609 (the "Company," "we," "us," or "our") operates the Platform and is the controller of personal information described in this Policy, except where applicable law provides otherwise.

1.2 Scope. This Consumer Privacy Policy applies to personal information the Company collects from or about a Consumer through the Platform, including when the Consumer creates an account, submits a report, requests Administrative Services, communicates with the Company, or otherwise uses reportascam.com. This Policy does not alter the terms of a direct engagement between a Consumer and an independent attorney, a Business's privacy practices, or a service provider's own independently collected information.

1.3 Effective Date. This Policy is effective as of May 4, 2026.

1.4 Privacy Contact. Questions, requests, and appeals under this Policy may be submitted to legal@reportascam.com.

2. Definitions

2.1 Administrative Services. "Administrative Services" means technology-based and administrative services provided by the Company through the Platform at the Consumer's direction, including organization of Consumer-supplied information, transmission of Claim Notices, facilitation of communications, transmission of offers and responses without alteration, recording of Claim Status, and other nonlegal services described in the applicable agreement. Administrative Services do not include legal advice, legal representation, claim ownership, settlement acceptance or rejection, filing or prosecution of proceedings, or receipt of settlement funds.

2.2 Business. "Business" means a person, entity, or organization identified in a report submitted through the Platform as the subject of a Consumer's Opinion Report or Transactional Report.

2.3 Business Content. "Business Content" means information, data, text, images, documents, and other materials submitted to or through the Platform by or on behalf of a Business, including responses to reports, settlement proposals, and profile information.

2.4 Claim. "Claim" means a Transactional Report submitted by a Consumer who has requested Administrative Services under a Claim Services Authorization. The Consumer retains ownership and settlement control of the Claim at all times.

2.5 Claim Services Authorization. "Claim Services Authorization" means the agreement between the Consumer and the Company under which the Consumer authorizes the Company to provide Administrative Services with respect to a Claim. The Claim Services Authorization does not assign the Claim, grant a power of attorney, or transfer settlement authority to the Company.

2.6 Claim Status. "Claim Status" means a general, publicly displayable indicator of the current stage of a Claim (for example, "Submitted," "Notice Sent," "Response Received," "Resolution Process Active," or "Resolved"). Claim Status does not include the Claim amount, Transactional Report narrative, supporting documents, or Consumer identity.

2.7 Company. "Company" means REPORT A SCAM LLC, a Wyoming limited liability company, with an address at 5830 E 2nd St Ste 7000, Casper, Wyoming 82609.

2.8 Consumer. "Consumer" means an individual who creates an account on the Platform and submits a report or requests Administrative Services.

2.9 Consumer Content. "Consumer Content" means information, data, text, images, documents, and other materials submitted to or through the Platform by or on behalf of a Consumer, including Opinion Reports, Transactional Reports, supporting documents, and communications.

2.10 Opinion Report. "Opinion Report" means a Consumer-submitted report expressing the Consumer's opinion about a Business or transaction. Opinion Reports may be displayed publicly, subject to the Consumer Terms of Service.

2.11 Platform. "Platform" means the technology platform operated by the Company at reportascam.com, including associated websites, applications, portals, tools, and services.

2.12 Transactional Report. "Transactional Report" means a Consumer-submitted report that describes a specific commercial transaction and may form the basis of a Claim. Transactional Report narratives and supporting documents are not published without separate consent.

3. Information We Collect

3.1 Account Data. We collect account registration and profile information, including a Consumer's name, email address, state of residence, mailing address, telephone number if provided, account credentials, and account preferences.

3.2 Report and Claim Data. We collect information included in a report or Claim, such as the Business's identity, transaction details, a narrative, the amount asserted by the Consumer, dates, Consumer Content, and supporting documents. Transactional Report narratives and supporting documents are not published without separate consent.

3.3 Communications. We collect communications sent through the Platform or to the Company, including inquiries, Claim Notices, Business responses, settlement proposals, Consumer instructions, and other messages relating to an account, report, or Claim.

3.4 Identity-Verification Data. We collect the identity-verification results, verification metadata, and other information necessary to verify identity and prevent fraud. Depending on the verification method, this may include information supplied to a verification provider as described in Section 4.

3.5 Device and Usage Data. We collect information about use of the Platform, including IP address, browser type and version, operating system, device identifiers, pages viewed, actions taken, access dates and times, and referring URLs.

3.6 Cookies and Similar Technologies. We use cookies, pixel tags, local storage, and similar technologies to operate the Platform, maintain sessions, remember preferences, protect security, and understand Platform usage. Section 17 provides additional information.

3.7 Information from Other Sources. We may receive identity-verification results from a verification provider and information about a Business from publicly available sources when reasonably necessary to identify the Business named in a report or Claim.

4. Identity Verification and Biometric Data

4.1 Identity Verification and Biometric Data. Depending on the verification method selected, a verification provider may process a government-issued identification document, facial image, facial geometry, or similar data to verify identity and prevent fraud. Where required, the Company will provide a separate notice and obtain consent before collection. The Company does not use biometric data for advertising or unrelated profiling. Retention and deletion follow the applicable biometric notice and law.

4.2 Verification Minimization. The Company uses identity-verification information only as reasonably necessary to verify identity, prevent fraud, secure the Platform, and meet applicable legal requirements. The Company does not retain copies of government-issued identification documents after verification unless retention is required by applicable law or is necessary for a documented security or fraud-prevention purpose.

5. Sensitive Data

5.1 Sensitive Data. The Company processes sensitive data only when reasonably necessary for a disclosed service and, where a stricter standard applies, only when strictly necessary to provide or maintain the specific service requested by the Consumer. Consent does not authorize processing prohibited by applicable law.

5.2 Categories and Controls. Sensitive data may include government identification information, biometric data, financial or transaction information contained in Consumer Content, and any other category treated as sensitive under applicable law. The Company uses sensitive data only for the purposes described in this Policy, subject to the limits and rights in Section 14 and any separate biometric notice.

6. Location Data

6.1 Location Data. The Company collects IP addresses and may infer approximate city- or region-level location. The Company does not collect precise device geolocation unless separately disclosed and authorized.

7. How We Use Information

7.1 Administrative Services. We use personal information to create and maintain accounts; receive, organize, and transmit Consumer Content; facilitate communications; transmit Claim Notices, offers, and responses without alteration; record Claim Status; and provide other Administrative Services at the Consumer's direction.

7.2 Security and Fraud Prevention. We use personal information to verify identity, authenticate access, detect and investigate fraud, misuse, security incidents, and violations of applicable terms, and protect the Company, the Platform, Consumers, Businesses, and service providers.

7.3 Communications and Platform Operations. We use personal information to respond to requests, provide account and Claim updates, maintain and improve Platform functionality, analyze aggregated or deidentified usage patterns, and administer fixed subscriptions, administrative fees, and Platform tools that are separately disclosed and affirmatively accepted.

7.4 Legal Compliance. We use personal information to comply with applicable law, respond to valid legal process, establish, exercise, or defend legal claims, enforce applicable terms, and meet recordkeeping obligations.

7.5 Public Display. We use information for public display only as authorized by the Consumer and applicable terms. Only Opinion Reports, approved Business responses, general Claim Status, and aggregated information may be displayed publicly. Transactional Report narratives, Claim amounts, and supporting documents will not be publicly displayed without separate consent. Publication decisions operate independently from whether a Business pays, settles, disputes, or rejects a Claim.

7.6 No Sale or Cross-Context Behavioral Advertising. The Company does not sell personal information and does not use it for cross-context behavioral advertising unless separately disclosed with an opt-out.

7.7 No Legal Services. The Company is not a law firm. The Company does not provide legal advice, legal opinions, or legal representation, does not select legal claims or remedies, and does not own or control any Consumer Claim.

8. Automated Processing and AI

8.1 Automated Processing and AI. Automated tools may assist with report classification and pattern detection. Outputs are recommendations subject to human review. Where applicable, Consumers may opt out, request human-only review, obtain information about relevant inputs and reasons, correct underlying data, challenge the result, and request reassessment. Automated tools do not independently initiate litigation or make final legal decisions.

8.2 Additional Consumer Choice. A Consumer may submit a request concerning automated processing through legal@reportascam.com. The Company will evaluate the request under applicable law and its technical and operational capabilities, and will not use automated processing to make a final decision that determines legal rights.

9. How We Share Information

9.1 General Standard. We share personal information only as described in this Policy, with the Consumer's direction or authorization where required, or as otherwise permitted or required by applicable law.

9.2 Business Named in a Claim. We may share information with the Business named in a Claim only as necessary to facilitate that Claim and only information the Consumer has approved for transmission. The Company does not share a Consumer's personal contact information, identity-verification information, or supporting documents with a Business unless the Consumer has approved the transmission or disclosure is required by law.

9.3 Independent Attorneys. We may share information with an independent attorney only when directed by the Consumer and subject to a direct attorney-client engagement. At the Consumer's request, the Platform may provide information about independent attorneys. The Consumer and attorney independently determine whether to enter an attorney-client relationship. The attorney controls intake, conflicts review, legal analysis, strategy, scope, fees, and work product. Attorney fees are established and collected by the attorney under the engagement agreement. The Company does not receive or share attorney fees.

9.4 Service Providers. We may share personal information with service providers that perform services for the Company, subject to contractual restrictions as described in Section 10.

9.5 Licensed Payment Providers. We may share information with a licensed payment provider solely to process a payment that the Consumer or Business has directed through that provider. Any settlement payment must be made directly to the Consumer or through a licensed payment provider. The Company will not receive, hold, or transmit settlement funds for the Consumer. No Company fee is deducted from the Consumer's recovery.

9.6 Regulators and Legal Process. We may disclose personal information to regulators, law enforcement, courts, or other parties when required by law, regulation, subpoena, court order, or other valid legal process, or when reasonably necessary to protect rights, safety, security, or the integrity of the Platform.

9.7 Corporate Transactions. We may disclose personal information to a successor or prospective successor in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the Company's business or assets, subject to applicable law and this Policy.

9.8 Excluded Recipients. The Company does not share personal information with downstream claim purchasers or litigation funding entities, and no Claim is assigned or sold.

10. Service Providers and Subprocessors

10.1 Service Providers and Subprocessors. The Company uses service providers for identity verification, hosting, communications, electronic signatures, payment processing, security, analytics, and AI-assisted processing. Each provider is subject to contractual purpose, confidentiality, security, and retention restrictions appropriate to the service. A current subprocessor list is maintained by the Company and is available on request through the Platform or by contacting the Company at legal@reportascam.com.

10.2 Provider Access. Service providers may access personal information only to provide services for the Company, follow the Company's documented instructions where applicable, comply with law, and maintain security. The Company evaluates providers using risk-based diligence appropriate to the services they perform.

11. Retention

11.1 Unified Retention Schedule.

(a) Account data: retained while the account is active and for twenty-four (24) months after account closure.

(b) Report and Claim data: retained for the later of Resolution or termination of the applicable services, plus four (4) years.

(c) Execution and acceptance records (including clickwrap and electronic signature audit trails): seven (7) years from the date of execution.

(d) Communications transmitted through the Platform: the later of Resolution or termination of the applicable services, plus four (4) years.

(e) Identity-verification results (pass or fail indicator and verification metadata): twenty-four (24) months from verification.

(f) Biometric data: retained only for the period stated in the applicable biometric notice and deleted no later than the earlier of the date the verification purpose is satisfied or the maximum period permitted by applicable law.

(g) Usage and device logs: eighteen (18) months.

(h) Cookies and similar technologies: as stated in the cookie disclosure, and in no event longer than thirteen (13) months for non-essential cookies.

The Business Privacy Policy applies the same schedule. Business Content and Business Claim responses are retained under subsection (b) because they form part of the same Claim record; no separate ten-year period applies.

11.2 Deletion and Exceptions. At the end of the applicable retention period, the Company will delete or deidentify personal information unless a longer period is required by law or a documented legal hold, security investigation, or dispute requires retention. Any retained information will remain subject to appropriate safeguards and use limitations.

12. Security

12.1 Security Controls. The Company maintains administrative, technical, and organizational safeguards designed to protect personal information. These safeguards include encryption in transit and at rest; access controls and least-privilege practices; logging and monitoring; risk-based vendor due diligence; incident-response procedures; and personnel training. No method of transmission or storage is completely secure, and the Company cannot guarantee absolute security.

13. Breach Notification

13.1 Breach Notification. The Company will notify affected persons and applicable regulators of a security breach within the period required by the law applicable to the affected person and data.

14. Your Privacy Rights

14.1 Available Rights. Subject to applicable law and verified-request requirements, a Consumer may request access to, correction of, deletion of, or a portable copy of personal information. A Consumer may also opt out of the sale of personal information, sharing of personal information, and targeted advertising where those rights apply; request limits on the use of sensitive data; and exercise the right not to receive discriminatory treatment for exercising privacy rights.

14.2 Universal Opt-Out Mechanisms. Where required by applicable law, the Company will honor a valid universal opt-out mechanism for the sale or sharing of personal information and targeted advertising. Because the Company does not sell personal information and does not use it for cross-context behavioral advertising unless separately disclosed with an opt-out, the effect of an opt-out may be limited.

14.3 Biometric Information. Rights concerning biometric data are also governed by the separate biometric notice provided when required. A Consumer may use the process in this Section 14 to submit a request concerning biometric data, subject to that notice and applicable law.

14.4 Submitting a Request. A Consumer may submit a privacy request through legal@reportascam.com or through an available privacy-request feature in the Platform. The Company may request information reasonably necessary to verify identity, protect personal information, and process the request. The Company will respond within forty-five (45) days and may extend that period once by an additional forty-five (45) days when reasonably necessary, with notice as required by applicable law.

14.5 Authorized Agents. An authorized agent may submit a privacy request on a Consumer's behalf. The Company may require evidence of the agent's authority and verification of the Consumer's identity, to the extent permitted by applicable law.

14.6 Appeals. If the Company denies a request, the Consumer may appeal by submitting an appeal to legal@reportascam.com and identifying the decision being appealed. The Company will respond to an appeal within forty-five (45) days and may extend that period once by an additional forty-five (45) days when reasonably necessary, with notice as required by applicable law. If an appeal is denied, the Company will provide information about any additional recourse available under applicable law.

15. Children's Data

15.1 Children's Data. The Platform is not directed to children under eighteen (18), and the Company does not knowingly collect personal information from children. If the Company learns that it collected personal information from a child contrary to applicable law, it will take appropriate steps to delete the information. A person who believes a child has provided personal information may contact legal@reportascam.com.

16. International Transfers

16.1 International Transfers. The Platform is operated from the United States. If personal information is transferred to, processed in, or accessed from a country other than the country in which it was collected, the Company will use safeguards required by applicable law for that transfer. Privacy and data-protection laws in the destination country may differ from those in the Consumer's country of residence.

17. Cookies and Tracking

17.1 Cookies and Similar Technologies. The Company uses essential cookies to operate and secure the Platform and may use non-essential cookies or similar technologies for preferences, analytics, and other disclosed purposes. Consumers may manage cookies through browser or device settings and through any available Platform preference controls. Disabling certain cookies may affect Platform functionality.

17.2 Retention. The retention of cookies and similar technologies is governed by Section 11.1(h). The Company will not retain non-essential cookies for longer than thirteen (13) months.

18. Changes to This Policy

18.1 Changes. The Company may update this Policy from time to time. If a change is material, the Company will provide notice through the Platform, by email, or by another method required by applicable law before the change takes effect. The updated Policy will identify its effective date.

19. Relationship to Consumer Terms

19.1 Relationship to Consumer Terms. This Policy describes the Company's collection, use, disclosure, retention, and protection of personal information. The Consumer Terms of Service separately govern use of the Platform. This Policy does not limit any privacy right or remedy that cannot be limited under applicable law. If the Consumer Terms and this Policy address the same data-processing practice inconsistently, this Policy controls with respect to the Company's privacy disclosures and data-processing commitments.

19.2 Defined Terms. Capitalized terms used but not defined in this Policy have the meaning given to them in the Consumer Terms of Service.

20. Contact

20.1 Contact Information. For questions, concerns, privacy requests, or appeals, contact the Company at:

REPORT A SCAM LLC
5830 E 2nd St Ste 7000
Casper, Wyoming 82609

Privacy Email: legal@reportascam.com