Squeez Privacy Policy

1Who we are and what this Policy covers

1.1Squeez, Inc. (“Squeez,” “we,” “us” or “our”) is a Delaware corporation based in Tampa, Florida. This Policy covers personal information Squeez collects through its consumer services, websites, applications, Local Luxury™, white-label and partner experiences for existing brands, AI and agent functionality, transactions, loyalty redemption and earn, and customer support (the “Services”).

1.2Squeez is the controller of the personal information it collects through the Services, including white-label experiences; Section 11 explains this role. Where a loyalty program (“Program”), venue or experience operator (“Provider”) or other partner collects information on its own surfaces, that partner’s privacy notice applies to that collection.

2Information Squeez collects

2.1Depending on how you use the Services, Squeez may collect:

1. (a)Account and contact information: name, email address, mobile number, postal address, password or passkey and account settings.
2. (b)Age and eligibility information.
3. (c)Searches, Requests, offers, waitlist entries and saved preferences.
4. (d)Booking and transaction history, including the Experience, Provider, date, party size, price and type of payment method.
5. (e)Payment-support and tokenized payment information. Squeez’s payment partners process card details; Squeez does not store card numbers or card verification values after authorization.
6. (f)Loyalty identifiers, tier, balances and redemption or earn activity from Programs you connect or use.
7. (g)Communications with Squeez and with Providers through the Services, including emails, texts, chats and calls, which may be recorded and transcribed.
8. (h)AI conversations and instructions you give Squeez’s assistants and agents, and the actions taken on them.
9. (i)Device, browser, IP address, approximate location, app and operating system information, and cookie and SDK events.
10. (j)Precise location, if you enable it.
11. (k)Session activity on Squeez websites, such as pages viewed, clicks, scrolling and mouse movement, which may be recorded and replayed (Section 9).
12. (l)Connected-account information you authorize Squeez to access, such as loyalty, payment, calendar or reservation accounts.
13. (m)Identity-verification and fraud signals.
14. (n)Customer-service records.
15. (o)Information from Providers and Programs about your Requests, Bookings, membership and activity.
16. (p)Information from identity-verification, data and marketing providers, including demographic, household and contact information and signals about the authenticity and tenure of a mobile number.
17. (q)Marketing and attribution information, such as the campaign that brought you to Squeez.
18. (r)Inferences and estimates Squeez creates from the information above, including preferences and estimates of likely spending range and household characteristics.

2.2Sources. Squeez collects this information from you; from your devices and browsers; from Providers and Programs; from Squeez’s payment, verification, data and marketing providers; from public sources; and from the AI conversations and actions you have with Squeez.

3Sensitive information, payment data and credentials

3.1Squeez processes higher-risk information — such as precise geolocation, financial and payment information, account credentials or tokens, and information treated as sensitive under applicable law — only for disclosed and permitted purposes. Squeez minimizes storage of payment-card data and does not keep card verification values after authorization.

3.2Squeez receives connected-account credentials only where an integration requires them. Where feasible, Squeez uses delegated authorization and token-based access. Credentials and authentication secrets are protected with technical and organizational controls appropriate to the risk.

4Why Squeez uses information

4.2Estimates. Squeez may estimate a member’s likely spending range and household characteristics using deterministic and probabilistic models built from the information in Section 2. These estimates help Squeez and its partners present the right Experiences and offers. Squeez does not use them to decide eligibility for credit, insurance, employment or housing.

4.3Squeez also uses information to:

1. (a)provide accounts and the Services;
2. (b)identify and authenticate users;
3. (c)find and request inventory, including through Offline Access™ and Squeez Requests;
4. (d)complete Bookings and payments, and act as merchant of record where applicable;
5. (e)operate loyalty redemption and earn;
6. (f)provide customer support;
7. (g)personalize and rank recommendations;
8. (h)create and maintain agent memory;
9. (i)run Local Luxury™ and your direct relationship with Squeez (Section 5);
10. (j)operate AI agents on your instructions;
11. (k)communicate with Providers at your direction;
12. (l)detect and prevent fraud and abuse;
13. (m)secure systems;
14. (n)calculate and reconcile commercial obligations with Providers and Programs;
15. (o)conduct analytics and attribution;
16. (p)market Squeez where permitted;
17. (q)improve products and models (Section 7);
18. (r)comply with law;
19. (s)establish and defend legal claims; and
20. (t)complete corporate transactions.

5Program experiences and your direct relationship with Squeez

5.1When a Program, hotel, golf operator or other partner supplies information for an experience Squeez operates for it, Squeez uses that information to run the experience, fulfill transactions, provide approved personalization, maintain security and fraud controls, reconcile commercial obligations and for other purposes the governing agreement and the law permit. Squeez does not use information a partner supplied, by itself, for unrelated direct Squeez marketing.

5.2You enter a direct relationship with Squeez, separate from any Program or Provider, when you:

1. (a)create a Squeez account;
2. (b)join Local Luxury™;
3. (c)contact Squeez directly or ask Squeez to keep you informed; or
4. (d)accept an invitation Squeez presents in the Services to continue with Squeez directly, for example after a Booking.

5.3Squeez presents that choice clearly and as a choice distinct from the Program. From that point, Squeez holds your information in its own right as the controller described in Section 11, maintains a single Squeez Profile for you — including information you gave in a Program-branded experience Squeez operates — and may use it to recognize you across Programs, Providers and categories, personalize the Services, and communicate with you directly, subject to your marketing choices in Section 15.

5.4Your direct relationship continues if your relationship with a Program ends or the Program stops working with Squeez. Squeez does not share your Squeez Profile back with a Program unless you direct it or a Program transaction requires it.

6Squeez-derived intelligence, insights and compensation

6.1Squeez creates aggregated, statistical, derived and model-based intelligence from transactions and permitted interactions. Squeez’s feature engineering, rankings, models, signals, scoring logic, merchant intelligence, pricing logic and aggregated insights are Squeez’s confidential intellectual property. Where derived information remains personal information under applicable law, Squeez handles it as personal information and your rights continue to apply. Properly deidentified or aggregated information may be used for any lawful business purpose.

6.2Squeez may be paid by Providers, Programs and other partners for services, outcomes and insights built on the information it holds. Where permitted by law and by its agreements, Squeez reserves the right to sell or share personal information as those terms are defined under applicable U.S. state privacy law, including through the advertising and retargeting technologies described in Section 9. Section 16 lists the categories involved. You can opt out of sale, sharing and targeted advertising at any time through Your Privacy Choices (Section 15). Information a Program or Provider supplies to Squeez under a written agreement is used only as that agreement allows.

7AI, model training and your opt-out

7.1Squeez uses AI conversations, feedback, transaction outcomes and derived signals to improve its generative, recommendation, ranking, fraud, pricing and other systems, where permitted. This is part of how the Services work.

7.2You may opt out of the use of your information to train Squeez’s models by emailing legal@trysqueez.com with a request to opt out. Squeez completes an opt-out within 3 business days of receiving it. The opt-out applies prospectively from completion; it does not require Squeez to retrain or reverse a model already trained, unless the law requires it. Squeez keeps a minimal suppression record to honor the choice.

8Personalization and ranking

8.1Squeez may personalize inventory, recommendations, timing, ranking, offers and loyalty experiences using stated preferences, prior behavior, transaction history, loyalty context, geography, availability, price and value, commercial economics and other permitted factors. Squeez may change models and factors over time. Where the law requires specific notice or rights for automated decision-making, Squeez provides them for covered processing (Section 18).

9Cookies, analytics, advertising and retargeting

9.1Squeez uses cookies, pixels, SDKs, local storage and similar technologies for essential functionality, security, session management, preferences, analytics, attribution, product improvement, advertising and retargeting. Today Squeez uses Microsoft Clarity, which records how visitors move through Squeez pages — clicks, scrolling and mouse movement — and may replay sessions as heatmaps and recordings, with the text typed into forms and payment fields masked; Google Analytics for measurement; and Google Ads, including remarketing, so that people who visit Squeez may see Squeez advertising elsewhere. Squeez may add or change vendors; the Cookie & Tracking Notice and the consent manager list the current ones.

9.2Under U.S. state privacy laws, using advertising and analytics technologies that pass information to another company for advertising across sites can count as a sale, sharing or targeted advertising. Squeez treats it that way. You can opt out through Your Privacy Choices, and Squeez honors Global Privacy Control signals as opt-out requests where the law requires. Where the law requires consent before non-essential cookies are set, Squeez asks before setting them.

10When Squeez discloses information

10.1Squeez may disclose personal information to:

1. (a)Providers, so they can fulfill your Request or Booking and recognize you when you arrive;
2. (b)Programs, to verify membership, redeem and credit Points and report activity under the Program’s rules;
3. (c)payment processors, acquirers, gateways and payment facilitators;
4. (d)reservation, point-of-sale, property-management, tee-sheet and integration providers;
5. (e)AI, model, cloud, security and identity-verification vendors;
6. (f)analytics and advertising providers, including Google, for the purposes in Section 9;
7. (g)professional advisers, insurers and auditors;
8. (h)affiliates;
9. (i)authorities, where the law requires or permits;
10. (j)counterparties in a corporate transaction, such as a financing, merger or acquisition; and
11. (k)other recipients at your direction or with your consent.

10.2Squeez contractually restricts its processors and service providers as applicable law and the applicable data role require.

11Squeez’s role: controller on every surface

11.1Squeez is the controller (or the equivalent under applicable law) of the personal information it collects through the Services and in transactions, including through white-label experiences for existing brands. A Program or Provider is the controller of the information it collects on its own surfaces and systems. Squeez and a partner may each act independently for different purposes within the same transaction.

11.2Squeez does not process personal information as a partner’s processor or service provider except where a written agreement says so for a specific service, in which case Squeez follows that agreement for that service.

12How long Squeez keeps information

12.1Squeez keeps information for as long as needed for the purpose it was collected for, subject to legal holds and mandatory law. Unless a different period is justified by law, contract or operational need, the baseline is:

1. (a)Transaction, booking, settlement, refund, chargeback, tax, accounting and loyalty reconciliation records: 7 years after the transaction closes.
2. (b)Terms acceptance, agent authority, material transaction consent and confirmation evidence: 7 years after the relevant transaction or the end of the account relationship, whichever is later where justified for claims or audit.
3. (c)Fraud, security and abuse investigation records: generally 7 years from closure where necessary for defense, repeat-abuse prevention or compliance, with periodic review.
4. (d)Raw AI conversations associated with an active user: up to 24 months for service quality, safety and improvement, unless you delete them sooner, a longer period is required for a dispute or security event, or the information is deidentified.
5. (e)Call recordings and transcripts: up to 24 months, unless a longer period is required for a dispute, security event or legal hold.
6. (f)Persistent agent memory: while the account or memory feature is active, subject to your controls and deletion rights; inactive personalized memory is reviewed for deletion or deidentification after 24 months of inactivity unless a longer retention basis applies.
7. (g)Estimates and derived profile information about a Program member who has not entered a direct relationship with Squeez (Section 5): up to 1 year after Squeez’s last interaction with that member, and deleted within 90 days of a valid deletion request, or sooner where the law requires.
8. (h)Precise location: only for the period reasonably necessary to provide the active location-dependent function, unless you save that information or a separate lawful purpose applies.
9. (i)Text-message consent records: while you are opted in and for 4 years after you opt out.
10. (j)Cookie and advertising identifiers: according to the applicable cookie configuration and your consent, as described in the Cookie & Tracking Notice.
11. (k)Privacy-request and deletion or suppression evidence: at least 5 years after completion where reasonably necessary to demonstrate compliance, without keeping deleted source content for that purpose.

13Deletion and deidentification

13.1A valid deletion request does not require Squeez to delete records it may lawfully keep for transaction completion, security, fraud prevention, accounting, dispute defense, compliance, suppression or another legal exception. Squeez restricts retained exception data to the permitted purpose and does not use deleted-profile exception data for unrelated active personalization where that is prohibited. Deidentified information is maintained with measures intended to prevent reidentification where the law requires.

14Security

14.1Squeez maintains administrative, technical and organizational safeguards appropriate to the Services and the information it holds, including encryption in transit, access controls, logging and vendor review, and runs its compliance program against recognized security frameworks. No security program eliminates all risk. If Squeez learns of a breach affecting your information, it will notify you and regulators as the law requires.

15Your U.S. privacy rights and choices

15.1Depending on your state, you may have the right to know or access the personal information Squeez holds about you, correct it, delete it, receive a portable copy, opt out of sale, sharing or targeted advertising, limit certain uses of sensitive personal information, appeal a decision and receive non-discriminatory treatment.

15.2How to exercise them. Email legal@trysqueez.com or use the Your Privacy Choices page at trysqueez.com/legal/privacy-choices. Squeez will confirm receipt and may ask you to verify your identity by matching information you provide against information Squeez holds. An authorized agent may submit a request for you with proof of authority; Squeez may still verify your identity directly.

15.3Timing. Squeez completes an opt-out of sale, sharing, targeted advertising or model training within 3 business days of receiving the request. Squeez responds to access, correction, deletion and portability requests within 45 days, and may extend once by a further 45 days where the law permits, telling you why. If Squeez declines a request, you may appeal by replying to Squeez’s response or emailing legal@trysqueez.com with “Appeal” in the subject line; if the appeal is denied, Squeez will tell you how to contact your state attorney general.

15.4Your Privacy Choices. The “Your Privacy Choices” link in the footer of trysqueez.com and in the Squeez app lets you opt out of the sale and sharing of your personal information and of targeted advertising. Squeez honors Global Privacy Control signals as an opt-out for the browser or device that sends them, where the law requires.

15.5Marketing. You can unsubscribe from marketing email using the link in any message, stop marketing texts by replying STOP, and withdraw other marketing permissions at legal@trysqueez.com. Service and account messages continue while you have an account.

15.6Non-discrimination. Squeez does not discriminate against you for exercising your rights. Loyalty and membership benefits are offered under program terms, and Squeez provides any notice of financial incentive the law requires when you enroll.

16California notice

16.1This section applies to California residents and supplements the rest of this Policy. The table lists the categories of personal information Squeez collects, for the purposes in Section 4, whether Squeez discloses each category to the recipients in Section 10 for a business purpose, and whether Squeez may sell or share it as California law defines those terms.

16.2Squeez uses sensitive personal information only for the purposes California law permits without a right to limit, such as providing the Services you request, security and fraud prevention, and does not use it to infer characteristics about you. Squeez does not knowingly sell or share the personal information of consumers under 16. Retention for each category follows Section 12.

16.3California residents may also request, once a year, information about disclosures of personal information to third parties for their direct marketing purposes under California Civil Code section 1798.83 by emailing legal@trysqueez.com.

17EEA, UK and international users

17.1Squeez’s consumer Services are offered to people in the United States, including when they book Experiences abroad. If you use the Services from the European Economic Area, the United Kingdom or Switzerland, the following also applies.

17.2Squeez processes personal information on the legal bases the law provides: performance of a contract with you, your consent, Squeez’s legitimate interests (such as security, fraud prevention, product improvement and direct marketing where permitted) and compliance with legal obligations. You may have rights of access, correction, erasure, restriction, objection, portability and withdrawal of consent, and the right to complain to a supervisory authority. International transfers use a legally recognized transfer mechanism, such as standard contractual clauses, where required. Contact legal@trysqueez.com.

18Automated decision-making and AI transparency

18.1Squeez uses AI and automated systems to personalize, rank, prevent fraud, assess transaction risk and carry out commerce you have authorized. Where applicable law creates transparency, access, opt-out or appeal rights for covered automated decision-making, Squeez provides the required notices and controls. Interactive AI is identified as AI where the law requires, including under applicable EU AI transparency obligations.

19Children and age

19.1Squeez consumer accounts are designed for users age 21 or older. Squeez does not knowingly collect personal information from children under 13 and deletes it if it learns it has. Providers may impose additional eligibility rules.

20Accessibility

20.1Squeez aims to make privacy notices and rights mechanisms accessible and designs its digital experiences toward WCAG 2.2 Level AA. Privacy requests and accessibility questions may be sent to legal@trysqueez.com.

21Changes and contact

21.1Squeez may update this Policy as products, data practices, vendors and laws change. Material changes will be communicated as the law requires, and the effective date at the top of this Policy will change. Earlier versions are available on request.

21.2Contact: legal@trysqueez.com. Mailing address: Squeez, Inc., c/o Embarc Collective, 802 E. Whiting St., Tampa, Florida 33602, United States.