Consumer Privacy Policy

DATA BROKER NOTICE: THE ENTITY MAINTAINING THIS WEBSITE IS REGISTERED OR REQUIRED TO REGISTER AS A DATA BROKER UNDER APPLICABLE STATE LAWS INCLUDING CALIFORNIA CIVIL CODE § 1798.99.80, TEXAS BUSINESS & COMMERCE CODE § 503A, OREGON REVISED STATUTES § 646A.570, AND VERMONT 9 V.S.A. § 2430. INFORMATION ABOUT DATA BROKER REGISTRANTS IS AVAILABLE THROUGH THE RESPECTIVE STATE REGISTRAR OFFICES.

1. Introduction and Scope

ZeetoGroup, LLC (“ZeetoGroup,” “we,” “us,” or “our”) is the parent company of Tibrio and its DBAs, which operate consumer-facing digital properties including scoredit.com, thesavvysampler.com, and other affiliated websites, sweepstakes, survey, and offer platforms (collectively, “our Properties”). This Consumer Privacy Policy (“Policy”) describes how ZeetoGroup and its subsidiary Tibrio collect, use, disclose, sell, and otherwise process the personal information of consumers who interact with our Properties. It also describes the rights available to consumers under applicable U.S. data privacy laws. ZeetoGroup operates as a data broker. We collect first-party and zero-party consumer personal information directly through our owned and operated Properties and sell or license that information to third-party business clients, including insurers, financial services companies, healthcare providers, home services companies, retailers, and other advertisers and agencies. This Policy applies to all consumers whose personal information we collect, process, or sell, regardless of whether they have directly visited zeeto.io. If you are a California resident, you have additional rights described in Section 9. If you are a resident of Texas, Oregon, or Vermont, state-specific disclosures are also provided in Section 9. This Policy is intended for U.S. residents only. Our Properties are not directed to residents of the European Union, United Kingdom, or other non-U.S. jurisdictions.

2. Who Collects Your Personal Information

Personal information described in this Policy is collected by ZeetoGroup, LLC and its subsidiary Tibrio. Any personal information collected through a Tibrio-operated property (including its DBAs) is owned by ZeetoGroup, LLC. The corporate structure is as follows:

‍

Entity	Role	Properties
ZeetoGroup, LLC	Parent company; data controller; registered data broker	zeeto.io
Tibrio (subsidiary of ZeetoGroup)	Operating subsidiary; collects first-party consumer data on behalf of ZeetoGroup	scoredit.com, thesavvysampler.com, and other DBAs

All personal information collected through Tibrio properties is transferred to and owned by ZeetoGroup, LLC, which serves as the data controller and data broker for purposes of applicable law.

3. Categories of Personal Information We Collect

We collect the following categories of personal information directly from consumers through our Properties, including surveys, sweepstakes entry forms, offer registration pages, and other consumer-facing digital experiences:

‍

Category	Examples	Collected?	Sold?
Identifiers	Name, email address, postal address, phone number, IP address, device identifiers, cookie IDs	Yes	Yes
California Customer Records Information	Name, address, phone number, email address, date of birth	Yes	Yes
Survey Responses / Intent Signals	Product interests, purchase intent, stated preferences, responses to questionnaires	Yes	Yes
Household Demographics	Date of birth, age, gender (Male/Female), marital status, household income range, homeownership status, presence of children	Yes	Yes
Internet / Electronic Activity	Clickstream data, browser type, operating system, pages visited, time on page, referral URL	Yes	Yes
Inferences	Consumer interest categories and audience segments derived from the above data	Yes	Yes
Geolocation (general)	State, city, and ZIP code derived from IP address or provided postal address	Yes	Yes
Sensitive Personal Information	See Section 4 below	See below	See below

4. Sensitive Personal Information

Certain categories of personal information are classified as “sensitive” under applicable law, including under the California Privacy Rights Act (CPRA). Our survey and offer registration forms may collect the following types of information that could constitute sensitive personal information depending on applicable law and context: Health-related interests and conditions, such as responses indicating interest in health insurance, Medicare plans, or medical products and services; Financial condition indicators, such as responses indicating interest in debt consolidation, personal loans, or credit products, which may reflect financial distress; Insurance status, such as whether a consumer currently has or is seeking auto, home, life, or health insurance coverage. To the extent any of the above constitutes sensitive personal information under applicable law, consumers have the right to limit its use and disclosure. See Section 8 for how to exercise this right. We do not sell sensitive personal information for purposes other than those permitted by law. We do not intentionally collect precise geolocation data, Social Security numbers, government-issued ID numbers, financial account credentials, biometric data, or the contents of private communications. If sensitive personal information is collected, consumers have the right to limit its use and disclosure. See Section 8 for how to exercise this right.

5. How We Collect Personal Information

We collect personal information through the following methods: Directly from consumers who complete surveys, sweepstakes entry forms, offer registration pages, or other interactive experiences on our Properties or on publisher partner sites that embed our forms; Automatically through cookies, web beacons, pixels, and similar tracking technologies when consumers interact with our Properties (see Section 6 for details); From publisher and co-registration partners on whose sites our data collection forms are embedded, where adequate consumer notice and consent is provided at the point of collection.

When you submit a form on any ZeetoGroup or Tibrio property, you are interacting directly with us. Before submitting personal information through any ZeetoGroup or Tibrio property form, consumers are presented with a clear disclosure of our data collection and sale practices and provide affirmative consent to the collection and sale of their information as described in this Policy. This consent is recorded at the time of submission and serves as the legal basis for our collection and subsequent sale of consumer personal information.

6. Cookies and Tracking Technologies

We and our partners use cookies, web beacons, pixels, and similar technologies to collect information about how consumers interact with our Properties. This information may include IP address, browser type, device type, pages visited, clickstream data, and unique identifiers. These technologies serve several purposes: To operate and improve our Properties; To associate consumer sessions with form submissions and consent records; To enable our advertising partners to serve relevant offers; To measure campaign performance on behalf of our clients. You may configure your browser to refuse cookies or alert you when cookies are being sent. Doing so may limit the functionality of our Properties. You may also opt out of interest-based advertising through the Network Advertising Initiative (networkadvertising.org) or the Digital Advertising Alliance (aboutads.info). We also honor Global Privacy Control (GPC) signals to the extent required by applicable law. See Section 8 for how to submit a Do Not Sell or Share request.

7. How We Use and Sell Personal Information

7a. Commercial Purposes

We collect and sell consumer personal information for the following commercial purposes: To sell or license consumer data to third-party business clients for their marketing, advertising, and lead generation purposes; To list consumer data on third-party data marketplaces, including the Snowflake Data Marketplace, for licensing to business buyers; To create and sell audience segments and interest-based data products derived from consumer survey responses and behavioral data; To match consumers with relevant advertiser offers at the point of data collection; To fulfill lead generation contracts with advertiser clients in categories including insurance, financial services, home services, healthcare, retail, and other verticals.

7b. Categories of Third Parties to Whom We Sell or Share Data

We sell or share personal information with the following categories of third parties:

‍

Category of Buyer	Examples of Use
Insurance companies and agencies	Marketing auto, home, life, health, and Medicare insurance products to consumers.
Financial services and lending companies	Marketing personal loans, credit products, debt consolidation, and financial planning services.
Home services companies	Marketing home improvement, warranty, security, and utility services.
Healthcare and Medicare providers	Marketing Medicare Advantage plans, supplemental insurance, and healthcare services.
Retail and e-commerce companies	Marketing consumer products, subscriptions, and promotional offers.
Advertisers and agencies	Targeted digital advertising, email marketing, and direct mail campaigns.
Data resellers and marketing platforms	Licensing data for further use in audience targeting and campaign activation.
Snowflake Data Marketplace buyers	Licensing aggregated consumer data sets for analytics and marketing.
Artificial intelligence and machine learning companies	Licensing consumer data for use in training, fine-tuning, or validating artificial intelligence and machine learning models, subject to applicable privacy law requirements and consumer opt-out rights. Consumers may opt out of this use of their data via the Do Not Sell or Share mechanism in Section 8.

7c. Service Providers

We may share personal information with service providers who assist us in operating our business, including cloud storage providers, data processing vendors, analytics providers, and technology platforms. These service providers are contractually required to use personal information only for the purposes of providing services to us and to maintain appropriate data security standards.

7d. Corporate Transactions

In the event of a merger, acquisition, asset sale, or similar corporate transaction, personal information in our possession may be transferred to the acquiring entity as part of that transaction.

7e. Legal Requirements

We may disclose personal information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our legal rights, prevent fraud, or protect the safety of any person.

7f. Legal Defense Retention

Notwithstanding any suppression or deletion request, we retain records necessary to establish, exercise, or defend legal claims. This includes records evidencing consumer consent to be contacted by telephone or text message by ZeetoGroup and its marketing partners, which are required to demonstrate compliance with the Telephone Consumer Protection Act (TCPA) and similar federal and state laws. Retained consent records include the date and method of consent, the consent language presented to the consumer, the IP address at the time of consent, and the identity of marketing partners to whom consent was extended. These records are stored separately from our active marketing systems, are accessible only for legal and compliance purposes, and are not used for any commercial purpose.

8. Your Privacy Rights

Depending on the state in which you reside, you may have the following rights with respect to your personal information. ZeetoGroup honors these rights for all consumers to the extent required by applicable law, including the Texas Data Privacy and Security Act (TDPSA, Chapter 541), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Oregon Consumer Privacy Act, and the Vermont Data Broker Regulation.

‍

Right	Description	How to Exercise
Right to Know / Access	Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties to whom it has been disclosed or sold.	Submit a request via our online form, email, or mail. Include your full name, email address, and postal address so we can locate and verify your record.
Right to Delete / Suppress	Request that your personal information be suppressed from use in our active marketing operations and excluded from future data sales. We will honor deletion requests to the extent required by applicable law, subject to our legal retention obligations. Certain data, including consent records and suppression records, may be retained as required by law or for legal defense purposes.	Submit a deletion or suppression request via our online form, email, or mail. We will confirm receipt within 10 business days and complete processing within 45 calendar days.
Right to Correct	Request correction of inaccurate personal information we hold about you.	Submit a correction request via our online form or email. Specify the data point(s) you believe are inaccurate and provide the correct information.
Right to Data Portability	Request a copy of the personal information you have provided to us in a portable, readily usable format that can be transferred to another entity.	Submit a portability request via our online form or email. We will provide your data in a commonly used electronic format within 45 calendar days.
Right to Opt Out of Sale or Sharing	Request that we stop selling or sharing your personal information with third parties for commercial purposes, including targeted advertising.	Use the "Do Not Sell or Share" link below, submit a request via our online form, or use a Global Privacy Control (GPC) browser signal. We will process your request within 15 business days.
Right to Limit Use of Sensitive PI	Request that we limit the use and disclosure of your sensitive personal information to only those purposes permitted by law.	Submit a request via our online form or email specifying that you wish to limit use of sensitive personal information.
Right to Non-Discrimination	We will not deny you services, charge you different prices, or provide a lower quality of service because you exercised any of your privacy rights.	No action required. This protection applies automatically.
Right to Opt Out via Global Privacy Control	We honor GPC browser signals as a valid opt-out of sale and sharing of personal information to the extent required by applicable law.	Enable GPC in a supported browser (e.g., DuckDuckGo, Brave, Firefox with a GPC extension). We will recognize the signal automatically when you visit our Properties.

‍

How to Submit a Privacy Rights Request — Step by Step

To exercise any of the rights listed above, follow these steps: Step 1 — Choose your submission method: Online Request Form https://privacyportal.onetrust.com/webform/06e3ef68-7a5d-49e9-8d24-7d52841ec504/6ba3bd2d-d4eb-41d5-b97e-554ff093fe0d (fastest): Email: support@zeetogroup.com Mail: ZeetoGroup, LLC, Attn: Privacy, 3131 West Bolt Street, Unit A19, Fort Worth, TX 76110

Step 2 — Include the following information in your request: Your full name Your current email address Your current postal address The specific right(s) you wish to exercise Any additional names, email addresses, or phone numbers that may be associated with your record (optional but helpful)

Step 3 — Identity Verification: We will verify your identity before fulfilling your request. We may ask you to confirm information we already hold on file. We will not require you to create an account to submit a request.

Step 4 — Our Response: We will acknowledge receipt of your request within 10 business days. We will respond to your request within 45 calendar days. If we need additional time, we will notify you and may extend the response period by up to an additional 45 days (90 days total). For deletion requests, your record will be suppressed from active marketing use and excluded from future data sales. Certain records may be retained as required by law. If we are unable to fulfill your request, we will explain the reason in our response.

Authorized Agents

You may designate an authorized agent to submit a privacy rights request on your behalf. To do so, your authorized agent must provide written proof of authorization, and we may separately verify your identity directly. Authorized agents submitting bulk requests (more than 100 at once) should contact us directly at support@zeetogroup.com to arrange batch processing.

Appeals Process

If we decline to take action on your privacy rights request, we will notify you of our decision and the reason within the applicable response period. You have the right to appeal our decision by submitting an appeal within 30 days of receiving our response. To submit an appeal: Email your appeal to support@zeetogroup.com with the subject line “Privacy Rights Appeal” Include your original request reference number or date of original request Describe the basis for your appeal

We will respond to your appeal within 45 calendar days. If your appeal is denied, we will provide you with information on how to contact the applicable state attorney general or privacy authority to submit a complaint.

Do Not Sell or Share My Personal Information

You have the right to opt out of the sale or sharing of your personal information at any time. To exercise this right: Submit a request via the link below or through our online privacy request form: https://privacyportal.onetrust.com/webform/06e3ef68-7a5d-49e9-8d24-7d52841ec504/6ba3bd2d-d4eb-41d5-b97e-554ff093fe0d

Use the Global Privacy Control (GPC) setting in a supported browser

➡ Do Not Sell or Share My Personal Information: https://privacyportal.onetrust.com/webform/06e3ef68-7a5d-49e9-8d24-7d52841ec504/6ba3bd2d-d4eb-41d5-b97e-554ff093fe0d

Once we receive and verify your opt-out request, we will process it within 15 business days and will not sell your personal information to new third parties. We will make reasonable efforts, where feasible, to inform third parties who have previously received your personal information of your opt-out request.

9. State-Specific Disclosures

California Residents (CCPA / CPRA)

ZeetoGroup is registered or required to register as a data broker with the California Privacy Protection Agency (CPPA) under California Civil Code § 1798.99.80 (the California Delete Act). California residents have all of the rights described in Section 8, plus the following: The right to request deletion of your data via California's DELETE Request and Opt-out Platform (DROP), available now at https://consumer.drop.privacy.ca.gov/. ZeetoGroup is required to process DROP requests at least once every 45 days beginning August 1, 2026. The right to limit the use and disclosure of sensitive personal information. The right to opt out of automated decision-making to the extent applicable.

Annual Consumer Request Metrics (as required by CCPA § 1798.121): ZeetoGroup began operating as a registered data broker in 2026. Annual consumer request metrics for the period January 1 – December 31, 2026 will be published here on or before January 31, 2027, as required by CCPA § 1798.121.

Texas Residents

ZeetoGroup is registered or required to register as a data broker with the Texas Secretary of State under Texas Business & Commerce Code § 503A. Texas residents may submit opt-out and deletion requests as described in Section 8.

Oregon Residents

ZeetoGroup is registered or required to register as a data broker with the Oregon Department of Consumer and Business Services under Oregon Revised Statutes § 646A.570. Oregon residents may submit privacy rights requests as described in Section 8.

Vermont Residents

ZeetoGroup is registered or required to register as a data broker with the Vermont Secretary of State under 9 V.S.A. § 2430. Vermont residents may submit opt-out and deletion requests as described in Section 8. Vermont data broker security breaches in the prior calendar year: [TO BE UPDATED ANNUALLY]

10. Data Retention

We retain personal information for the period necessary to fulfill the purposes described in this Policy, subject to the following guidelines:

‍

Data Category	Retention Period
Active consumer profiles (sold or available for sale)	Retained for the period necessary to fulfill our business and legal obligations. Records subject to a suppression or deletion request are flagged as Do Not Contact and excluded from active marketing use, but may be retained in suppressed form as required by applicable law and our legal retention obligations.
Consent and TCPA records	Retained for the duration of applicable statutes of limitations, which may exceed 4 years depending on the nature of the claim and applicable law. Consent records include evidence of express written consent to contact by telephone or text message.
Suppression / opt-out records	Indefinitely, to prevent re-collection and re-contact.
Legal defense records	Duration of applicable statute of limitations for relevant claims.
Website analytics and clickstream data	Up to 13 months.

Personal information is disposed of securely at the end of applicable retention periods. We maintain a written data retention policy governing these periods.

11. Data Security

ZeetoGroup maintains a written, comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the size and nature of our business and the sensitivity of the personal information we handle. Our security program includes, at minimum: Designation of a responsible employee for maintaining our information security program; Regular risk assessments and employee security training; Access controls and unique user authentication for all systems containing personal information; Encryption of personal information in transit across public networks and on portable devices; Firewall protection, up-to-date operating system patches, and anti-malware software; Contractual security obligations imposed on all third-party service providers who handle personal information on our behalf; Annual review of our security program and documented incident response procedures.

No data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately using the information in Section 13.

12. Children’s Privacy

Our Properties are not directed to children under the age of 18, and we do not sell or license personal information of individuals we know to be under 18. Our forms collect date of birth, which we use to identify and exclude individuals under 18 from our marketed data products and from any data sold or licensed to third-party buyers. We do not knowingly collect personal information from children under the age of 13. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it promptly in accordance with the Children’s Online Privacy Protection Act (COPPA). If you believe we may have collected information from a child under 13, please contact us at support@zeetogroup.com. Because date of birth is actively collected on our Properties, we maintain procedures to screen submitted data and suppress records belonging to individuals under 18 before that data is made available for sale or licensing to any third party.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, applicable law, or data broker registration requirements. When we make material changes, we will update the “Last Updated” date at the top of this Policy. We encourage you to review this Policy periodically. Continued use of our Properties after any changes constitutes your acknowledgment of the revised Policy.

14. Contact Us

If you have questions or concerns about this Policy, or to exercise any of your privacy rights, please contact us:

ZeetoGroup, LLC Attn: Privacy / Legal Address: 3131 West Bolt Street, Unit A19, Fort Worth, TX 76110 Email: support@zeetogroup.com

Privacy Rights Request Form: https://privacyportal.onetrust.com/webform/06e3ef68-7a5d-49e9-8d24-7d52841ec504/6ba3bd2d-d4eb-41d5-b97e-554ff093fe0d

Do Not Sell or Share Link: https://privacyportal.onetrust.com/webform/06e3ef68-7a5d-49e9-8d24-7d52841ec504/6ba3bd2d-d4eb-41d5-b97e-554ff093fe0d

We will respond to your request within the timeframe required by applicable law.

This policy was prepared for internal review purposes. Fields marked [IN BRACKETS] must be completed before this policy is published. This document should be reviewed by qualified legal counsel before going live.

‍