Privacy Policy

Effective: August 9, 2026 · Last updated: August 9, 2026

MetaOriental Technology Inc. ("MetaOriental," "we," "us") explains here what personal information we collect, why, who we share it with, and the choices and rights you have.

Quick links: Your Privacy Choices · Cookie Notice · Notice at Collection · Terms of Use

Short version. We collect information you give us, information about how you use the Service, and information from brands, retailers and platforms we work with. We use it to run and improve the Service, to attribute referrals and creator activity, to prevent fraud, and — with your permission — to personalize and measure advertising. We do not sell your personal information for money, and we do not share it for cross-context behavioural advertising except as described in the Cookie Notice. That sharing still counts as a "sale" or "sharing" under several state privacy laws, and you can turn it off at any time. We honor Global Privacy Control.

1. Scope

This Policy applies to metaoriental.com and its subdomains, our applications, newsletters, community, creator tools, and other services that link to it (the "Service"). It does not apply to third-party sites, stores, social platforms or brands, which have their own policies.

2. Information we collect

2.1 Information you provide

2.2 Information collected automatically

Device and browser type, operating system, language, approximate location derived from IP address, IP address, unique and probabilistic identifiers, cookie and pixel identifiers, referring and exit pages, pages and products viewed, videos viewed and playback events, searches, clicks, scroll and dwell behaviour, add-to-cart and checkout events, attribution parameters from tracking links and codes, session and error logs, and anti-fraud signals.

2.3 Information from others

• Brands, retailers and commerce platforms (including Shopline): order, fulfilment, refund, chargeback and attribution data relating to purchases connected to the Service.
• Advertising and analytics providers: measurement, conversion and audience data.
• Social platforms: public profile and engagement data where you connect an account or where we index public content. Exactly what we read from each platform, and what we do with it, is in Section 5A.
• Payment providers: payment-status information relating to your orders. We do not currently receive identity or sanctions-screening information, because we do not yet make payouts — see Section 2.4.
• Public sources: publicly available product, company and creator information.

2.4 Sensitive information

We do not seek sensitive personal information through content, posts or messages. Do not submit government identification numbers, financial account credentials, precise geolocation, biometric data, or health, genetic, sexual-orientation, religious, union-membership or immigration information in content or messages.

Account log-in credentials. Your email address together with your password is sensitive personal information under California law. We collect it only to authenticate you, we store the password in hashed form, and we never use it for advertising, profiling or any purpose other than securing your account. You may ask us to limit our use of sensitive personal information as described in Section 8.

Tax, payout and identity verification — not collected today. We do not currently make payments to creators, partners or brands, and we do not collect taxpayer identification numbers, payout details, identity documents or sanctions-screening data. If and when payouts launch, we will collect a taxpayer identification number and payout details for the sole purposes of payment, tax reporting and withholding. Any identity or sanctions verification (KYC/KYB) that the law or our payment providers then require will be performed by a specialist verification provider: you would submit your identity document and any selfie or liveness image directly to that provider, not to us, and we would receive only a pass/fail result, a risk flag, a reference token, the verified name and country, and the audit evidence we are required to keep. We would not receive or store your identity-document image, document number or biometric template, and none of it would be used for advertising or profiling. We will update this Policy and give notice at the point of collection before any of this begins.

Consumer health data. We do not ask health-related questions. The on-site personality quiz asks about shopping habits and attitudes towards AI — not about sleep quality, fitness, physical condition, medical history or health goals — and we do not draw health inferences from what you browse or buy. If health-related questions are ever introduced, they will be governed by our separate Consumer Health Data Privacy Policy, collected only with separate consent obtained at the point of collection, never sold, and deletable at Your Privacy Choices.

3. How and why we use information

About AI training. We use aggregated, anonymized or de-identified data that cannot reasonably be used to identify you to improve the Service, including search, ranking, recommendation, fraud detection and content tooling. We do not sell your personal information to third parties for the training of their general-purpose models. We do not use the content of your private support messages to train general-purpose models.

About the AI shopping assistant. When you use the on-site AI assistant, your messages and a limited amount of context — the products under discussion and, if you are signed in, the shopping preferences and quiz result already on your profile — are sent to Google and processed by Google's Gemini models so the assistant can reply. If you state a shopping preference during the conversation, the assistant may save a short version of it to your profile to improve later recommendations; you can review and delete saved preferences at Your Privacy Choices. Community posts are processed by the same models to generate summaries, tags and recommendations. Please do not type payment details, government identification numbers or health information into the assistant.

4. Cookies, pixels and similar technologies

We and our partners use cookies, pixels, SDKs, local storage and similar technologies. Analytics and advertising technologies — including Google Tag Manager, Google Analytics and the Meta pixel — load only in accordance with your consent choices, as described in the Cookie Notice, and you can change those choices at any time.

Full detail, including a current vendor list, is in the Cookie Notice. You can manage choices through our cookie preferences tool, at Your Privacy Choices, or through your browser.

Global Privacy Control. We honor Global Privacy Control: if your browser sends a GPC signal, we treat it as an opt-out of sale and sharing of personal information for that browser.

5. Video viewing information

Parts of the Service include video. To the extent the Video Privacy Protection Act, 18 U.S.C. § 2710, or a comparable law applies, we disclose video-viewing information that identifies you to analytics or advertising recipients only where you have given the separate, distinct, unchecked-by-default consent described in Section 12.2 of the Terms of Use, presented on its own screen before or at the point of playback. That consent lasts two years unless you withdraw it earlier, and you may withdraw it at any time, without penalty and without losing access to the Service, at Your Privacy Choices.

Where that consent has not been given or has expired, video measurement is limited to aggregate or de-identified metrics that are not linked to an account, device identifier or advertising identifier, and video features remain fully available to you.

5A. Connected social accounts and platform integrations

Connecting a social account is optional and never required to shop on MetaOriental. There are two separate features, and neither one gives us standing access to your account.

5A.1 Creator verification (a one-time read)

If you apply to the creator program, you may connect a social account so we can confirm that the channel you are applying with is yours. We make a single read at the moment you connect, and nothing after that.

Applies to every connected account:

• We store no access or refresh tokens. Any token issued during sign-in is discarded immediately after the one-time read, so we cannot access your account again unless you connect it once more.
• We never post, upload, modify or delete anything on your behalf through this feature. The only upload the Service can perform is the TikTok share described in 5A.2, which you start yourself.
• We do not sell, transfer or share this data with third parties, and we do not use it for advertising or to build profiles beyond assessing your creator application.
• A person reviews every application. A newly connected account is recorded as pending; no account is approved or rejected automatically.
• Deletion. Email legal@metaoriental.com to have a connected account and its stored data removed. Removing it does not affect your MetaOriental shopping account.

By connecting a YouTube channel you agree to the YouTube Terms of Service, and you acknowledge the Google Privacy Policy. You can revoke our access at any time at Google security settings.

MetaOriental's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5A.2 Sharing a product video to your own TikTok

If you choose to share a product video to TikTok, we ask for your permission using the video.upload scope and then upload that one video into your own TikTok inbox, where it stays as a draft until you decide whether to post it. This happens only when you start it, only for the video you selected, and we do not publish anything to your followers. We do not read your TikTok content, and the token issued for the upload is not retained for any other purpose.

6. Who we share information with

We share personal information with:

1. Service providers acting on our instructions — hosting and database infrastructure, content delivery and media hosting, email delivery (and SMS delivery only where SMS is enabled), analytics, customer support, fraud prevention, and payment processing. They may use it only to provide services to us. If and when payouts launch, this will also include identity, tax verification and payout providers (see Section 2.4).
2. AI model providers — Google. Your AI-assistant messages, the product context of that conversation, and community posts are processed by Google's Gemini models so the assistant can reply and so community content can be summarized and recommended. Google processes this on our instructions for that purpose. See Section 3.
3. Commerce and fulfilment partners, including Shopline, payment processors, warehouses and carriers, to complete and support transactions.
4. Brands and sellers, where necessary for an order, a warranty claim, a return, a recall, a creator task or a dispute. We provide brands with aggregated or pseudonymized reporting by default; we do not give brands your name or contact details except where necessary for a specific order, task, prize or safety matter.
5. Advertising partners, where you have consented, for advertising delivery, audience matching and measurement. Under California and several other state laws this can constitute a "sale" or "sharing"; you may opt out at Your Privacy Choices.
6. Professional advisers, insurers and auditors under confidentiality obligations.
7. Legal and safety recipients — law enforcement, regulators, courts and other parties where we reasonably believe disclosure is required by law or necessary to investigate fraud, enforce our terms, protect rights, property or safety, or establish or defend legal claims. See the Law Enforcement & Legal Requests Guidelines.
8. Corporate transactions — an acquirer or successor in a merger, financing, reorganization or asset sale, subject to this Policy or a policy with comparable protections.

Public by design. Your username, avatar, profile description, posts, comments, reviews, ratings and poll participation are visible to others. Do not post anything you want to keep private.

7. Sale and sharing under U.S. state privacy laws

In the preceding twelve months we have disclosed for business purposes the categories of personal information described in Section 2 to the recipient categories described in Section 6.

We have "shared" for cross-context behavioural advertising, and in some states this also counts as a "sale", the following categories: identifiers (including cookie and advertising identifiers), internet and network activity information, commercial information about products viewed or purchased, and inferences drawn from that information.

We do not sell or share the personal information of consumers we know to be under 16.

We do not sell your personal information for money, and we do not share it for cross-context behavioural advertising except as described in the Cookie Notice.

To opt out: Your Privacy Choices, or enable Global Privacy Control in your browser.

8. Your rights

Depending on where you live, you may have the right to:

• Know / access the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients;
• Delete personal information we hold about you;
• Correct inaccurate personal information;
• Portability — receive a copy in a portable format;
• Opt out of sale, sharing, targeted advertising, and profiling that produces legal or similarly significant effects;
• Turn off personalized recommendations — separately from the opt-outs above, you may switch off personalization at Your Privacy Choices and see non-personalized content instead, with no loss of access to the Service;
• Limit the use of sensitive personal information — the only sensitive personal information we hold is your account log-in credentials (Section 2.4), which we use solely to authenticate you; you may still submit a limit request at Your Privacy Choices and we will confirm how that information is used;
• Withdraw consent, including consent to video-viewing disclosure and to advertising cookies;
• Non-discrimination — we will not deny service, charge different prices or provide a different quality of service because you exercised a right;
• Appeal a decision we make about your request.

How to exercise. Submit a request at metaoriental.com/legal/privacy-request, email legal@metaoriental.com, or use Your Privacy Choices.

Verification. We verify requests using information already associated with your account. We may ask for additional information where necessary and proportionate. We do not create new accounts or collect new identifiers solely to verify a request.

Authorized agents. An agent may submit a request with written authorization; we may contact you to confirm.

Timing. We respond within 45 days, extendable once by another 45 days where reasonably necessary, and we will tell you if we need the extension.

Appeals. If we decline a request, you may appeal by replying to our decision or emailing legal@metaoriental.com with the subject "Privacy Appeal." We respond to appeals within 45 days with a written explanation. If your appeal is denied, you may contact your state Attorney General.

9. Retention

We keep personal information only as long as needed for the purpose it was collected, and then delete or de-identify it. Indicative periods:

10. Security

We use administrative, technical and physical safeguards including encryption in transit, access controls on a least-privilege basis, credential management, logging, vendor due diligence and incident response procedures. No method of transmission or storage is completely secure. If we become aware of a security incident affecting your personal information we will notify you and regulators as required by law and without undue delay.

11. Children

The Service is intended for adults aged 18 and over. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us information, contact legal@metaoriental.com and we will delete it. Products for infants and children may appear on the Service; they are marketed to adult purchasers.

12. Where this Policy applies, and international transfers

Territorial scope. The Service is directed to users located in the United States and this Policy is written to United States federal and state law. We do not offer, market or target the Service to individuals in the European Economic Area, the United Kingdom or Switzerland, and we do not knowingly collect their personal information in that capacity. This Policy is not a notice under the EU or UK General Data Protection Regulation and does not purport to satisfy it. If we begin to offer or target the Service in one of those jurisdictions, we will publish a separate regional privacy notice — with the legal bases, transfer mechanism, retention detail and data-subject rights those laws require — before we do so. Personal information we receive from a business partner outside the United States (for example a brand or supplier in mainland China) is received under our written agreement with that partner, and that partner is responsible for completing the export mechanism required in its own jurisdiction.

International transfers. We are based in the United States and process information in the United States and in other countries where our service providers operate. Where we receive personal information from outside the United States, we use appropriate safeguards, which may include standard contractual clauses, and we require service providers to protect it consistently with this Policy. Where personal information originates in mainland China, the party subject to the obligation completes the applicable cross-border mechanism before transfer.

13. Third-party links, embeds and platforms

The Service links to and embeds content from third-party platforms and sites. Loading or interacting with that content is governed by those parties' terms and privacy policies and may allow them to set cookies and collect data. See the External Links & Embedded Content Policy.

14. State-specific disclosures

California. In addition to the rights above, you may request the categories of personal information disclosed for a business purpose and the categories of recipients. Sections 2, 3, 6, 7, 8 and 9 provide the required Notice at Collection content; a short-form version is at Notice at Collection. California residents may also designate an authorized agent and may appeal as described in Section 8.

Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws. You have the rights described in Section 8 to the extent your state law provides them, including the right to opt out of targeted advertising, sale and certain profiling, and the right to appeal.

Nevada. You may direct us not to sell certain covered information; contact legal@metaoriental.com.

Washington and Nevada consumer health data. We do not collect consumer health data. As described in Section 2.4, the on-site quiz asks nothing about health, and we draw no health inferences from browsing or purchases. If we ever introduce health-related questions, they will be governed by a separate Consumer Health Data Privacy Policy that controls over this policy for that data, collected only with separate consent for collection and a second, distinct consent for any sharing, never sold, deletable at any time at Your Privacy Choices or by emailing legal@metaoriental.com, and kept for no longer than 24 months.

15. Changes

We will post any update with a new "Last updated" date and, for material changes, give notice in-product, by banner or by email before the change takes effect. Where required, we will obtain your consent.

16. Contact

MetaOriental Technology Inc. Attn: Privacy 61 W 62nd Street, 8H, New York, NY 10023 legal@metaoriental.com

Notice at Collection

Effective: August 9, 2026 · Last updated: August 9, 2026

This short notice tells you, at or before the point of collection, what we collect and why. Full detail is in the Privacy Policy.

1. What we collect and why

We do not collect biometric data or precise geolocation through the website, and we ask you not to submit government identification numbers, biometric data or precise geolocation in content, posts or messages.

We do not collect consumer health data. The on-site quiz asks about shopping habits and attitudes towards AI, not about health, and we draw no health inferences from what you browse or buy.

Payouts are not live yet. We do not currently collect taxpayer identification numbers, payout details or identity documents. If and when payouts launch, any identity and sanctions verification will be run by a specialist provider to whom you would submit your identity document directly — we would receive only a pass/fail result, a reference token and the verified name and country. See Privacy Policy §2.4.

2. Sale and sharing

We do not sell your personal information for money, and we do not share it for cross-context behavioural advertising except as described in the Cookie Notice.

With your consent, we share identifiers, internet activity and commercial information with advertising partners for cross-context behavioural advertising and measurement. Under California and several other state laws this counts as "sale" or "sharing."

Opt out here: Your Privacy Choices — or enable Global Privacy Control in your browser.

We do not sell or share the personal information of consumers we know to be under 16.

3. Sensitive personal information

The only sensitive personal information we collect is your account log-in credentials — your email address together with your password, which we store hashed and use solely to authenticate you. We never use it for advertising, profiling or any secondary purpose.

You have the right to limit our use of sensitive personal information, and you may exercise it at Your Privacy Choices even though our use is already confined to authentication; we will confirm in writing how the information is used. If payouts launch and we begin collecting a taxpayer identification number, it will be used only for tax reporting and withholding, and the same right will apply.

4. Your rights

You may request access, deletion, correction and portability, opt out of sale and sharing, limit use of sensitive information, withdraw consent, and appeal a decision. We will not discriminate against you for exercising a right.

Submit a request at metaoriental.com/legal/privacy-request or email legal@metaoriental.com. See Privacy Policy §8 for the full process.

Cookie Notice

Effective: August 9, 2026 · Last updated: August 9, 2026

This Notice explains how MetaOriental uses cookies, pixels, tags, SDKs, local storage and similar technologies (together, "cookies"). It supplements the Privacy Policy.

Manage your choices: [Cookie Preferences] · Your Privacy Choices

1. How consent works here

• Strictly necessary cookies load without consent. Everything else — analytics, personalization, advertising — loads only after you consent.
• Our consent banner offers Accept all, Reject all and Manage preferences with equal prominence. Rejecting is one click.
• You can change or withdraw consent at any time through the Cookie Preferences tool in the footer. Withdrawal applies going forward.
• We honor Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as an opt-out of sale and sharing for that browser.
• Consent is stored per browser and device. Clearing cookies clears your stored preference.
• MetaOriental Technology Inc. provides our consent management platform.

2. Categories we use

2.1 Strictly necessary — always on

Required for the Service to work. Cannot be switched off.

2.1.1 Browser storage we use instead of cookies

Some strictly necessary information is kept in your browser's local storage rather than in a cookie. It stays on your device, is not transmitted automatically with every request, and you can clear it at any time through your browser settings.

2.2 Performance and analytics — consent required

Help us understand how the Service is used so we can improve it.

2.3 Functional and personalization — consent required

2.4 Advertising and attribution — consent required

Used to deliver and measure advertising and to attribute referrals. Under California and several other state laws, use of these technologies may constitute a "sale" or "sharing" of personal information.

3. Third parties that may set cookies

The cookie that stores your own consent choice is set by us, not by a third party, and is covered in Section 2.1.

4. Embedded third-party content

Video and social embeds are loaded from the originating platform. Where consent is required, we load them only after you consent or only when you click to play. Once loaded, the platform may set its own cookies and receive your IP address and page URL under its own policy. See the External Links & Embedded Content Policy.

5. Browser and device controls

Most browsers let you block or delete cookies and send a Do Not Track or GPC signal. Mobile operating systems offer advertising-identifier controls. Blocking strictly necessary cookies will break parts of the Service.

• Chrome, Safari, Firefox and Edge: see the privacy or cookie settings in your browser.
• Global Privacy Control: globalprivacycontrol.org
• Interest-based advertising opt-outs: optout.aboutads.info and optout.networkadvertising.org

6. Retention

7. Changes and contact

We update this Notice when our technologies or vendors change. Questions: MetaOriental Technology Inc., Attn: Privacy, 61 W 62nd Street, 8H, New York, NY 10023 · legal@metaoriental.com.

Consumer Health Data Privacy Policy

Effective: August 9, 2026 · Last updated: August 9, 2026

What this policy is

This policy explains how MetaOriental handles consumer health data. It is separate from our general Privacy Policy, and where the two differ about consumer health data, this policy controls.

It applies to you if you are a consumer in Washington, Nevada, or any other state with a consumer health data law, and — because we apply one standard rather than a state-by-state one — we apply it to everyone.

MetaOriental Technology Inc., 61 W 62nd Street, 8H, New York, NY 10023, is the entity responsible for this data. We do not have processors or affiliates that collect consumer health data outside the arrangements described below.

1. What we treat as consumer health data

We treat as consumer health data any information that identifies your past, present or future physical or mental health status, or from which that status can be inferred. On our Service, that means:

What we do not treat as consumer health data: the fact that you viewed or bought a product in a broad category such as "Sport & Fitness," where we draw no health inference from it and do not link it to a health profile.

We do not collect: biometric identifiers, genetic data, precise location associated with health, reproductive or sexual health information, gender-affirming care information, or any information about seeking or obtaining healthcare services. We do not ask, and we ask you not to tell us. If you send us that kind of information anyway, we delete it.

2. Why we collect it, and the only purposes we use it for

We collect consumer health data for one purpose: to suggest products that may fit what you told us you are looking for.

We use it for that purpose and for the security, error-correction and legal-compliance activities necessary to run the Service. We do not use it for advertising, for building an advertising audience, for training models, for scoring or profiling you, or for any purpose we have not described here.

3. Consent — and how it is separated

We collect nothing until you say yes, and we share nothing until you say yes a second time.

• Collection consent is asked immediately before any health-related question, on its own, unchecked, with a link to this policy. Declining costs you nothing — you can skip the questions and continue.
• Sharing consent is a separate, additional checkbox. You can consent to collection and refuse sharing. Refusing sharing does not limit your use of the Service.
• Accepting our Terms of Use, our Privacy Policy or a cookie banner is not consent to anything in this policy.
• We record each consent with its text, timestamp, version and the recipient list shown to you at the time.

We never sell consumer health data. Selling it would require a separate signed authorization under state law; we do not offer one and we will not ask you for one.

4. Who we share it with

Recommendation processing happens in-house, on our own systems — no third party receives your answers or inferences to compute suggestions. Health information you volunteer in a support message passes through our email and support tooling as transport only; we do not copy it into recommendation systems, and we delete it from support archives on request.

That is the entire list. It is a real list of named vendors, not a category placeholder — if a vendor is added, this page is updated before the change takes effect, and anyone whose consent was given against the old list is asked again.

Not on the list, and never will be: advertising networks, data brokers, analytics providers used for advertising, social platforms, brands, and creators. No brand ever learns anything about your health from us — brands receive only aggregate, non-identifying category performance.

We also disclose consumer health data where we are legally compelled to, and we will tell you unless we are legally prohibited from doing so. See Law Enforcement & Legal Requests.

5. Your rights

You may, at any time and free of charge:

• Confirm whether we hold consumer health data about you, and get a list of everyone we shared it with;
• Access a copy of it;
• Withdraw either consent, which stops the relevant activity going forward;
• Delete it.

How deletion works here — this is stronger than our general privacy deletion:

1. We delete the data from our active systems and from our backups on our regular backup cycle;
2. We instruct every recipient listed in Section 4 to delete it too, and we confirm to you when they have;
3. We do not keep a "deleted" copy for analytics, model training or any secondary purpose;
4. We keep only the record that a deletion request was made and honoured.

How to ask: metaoriental.com/legal/privacy-request, or email legal@metaoriental.com with the subject "Health Data Request," or use Your Privacy Choices. We respond within 45 days, extendable once by 45 days with notice. If we decline, we tell you why and how to appeal; if we deny the appeal, you may contact your state Attorney General.

We will not discriminate against you, degrade your experience, or charge you differently for exercising any of these rights.

6. How long we keep it

Consumer health data is kept until you withdraw consent or delete it, and in any event no longer than 24 months from collection, after which it is deleted automatically. Inferences expire with the data they were drawn from.

7. How we protect it

Consumer health data is stored separately from our general profile data, encrypted at rest and in transit, and access-restricted to the small number of staff who need it to operate the recommendation feature. Access is logged. We do not permit access from any advertising, sales or brand-facing function.

8. Changes

If we change this policy in a way that expands what we collect, who receives it, or what we use it for, we obtain fresh consent before the change takes effect. We do not apply a new version retroactively to data collected under an older one.

9. Contact

MetaOriental Technology Inc. · 61 W 62nd Street, 8H, New York, NY 10023 legal@metaoriental.com · Your Privacy Choices