COMPLETE BEFORE PUBLISHING

Replace [LEGAL ENTITY NAME], [WEBSITE URL], [PRIVACY EMAIL], [MAILING ADDRESS], and [PRIVACY REQUEST URL/PHONE].

Confirm the machine manufacturer, payment processor, financing partner, analytics/advertising tools, retention periods, and whether cameras store images or video.

Delete this box after the policy has been matched to your actual practices and reviewed by qualified counsel.

1. Overview

This Privacy Policy explains how [LEGAL ENTITY NAME], doing business as VendSteward Group ("VendSteward," "we," "us," or "our"), collects, uses, discloses, and protects personal information. It applies when you visit [WEBSITE URL], submit an inquiry or application, purchase or finance equipment, participate in a managed vending program, communicate with us, or interact with a smart vending machine or related service that we operate or manage (collectively, the "Services").

This Policy does not apply to a third party's independent practices. A property owner, machine owner, manufacturer, payment processor, lender, or other partner may separately control personal information and provide its own privacy notice.

2. Personal Information We Collect

Information you provide

Identity and contact information, such as your name, business name, title, email address, telephone number, mailing address, and account credentials.

Business and application information, such as location type, foot traffic, proposed machine placement, business ownership information, equipment preferences, operational needs, and communications with us.

Transaction and financial information, such as purchase details, invoices, payout instructions, financing-related information, and limited payment information. Payment card information is generally collected directly by our payment processor rather than stored by VendSteward.

Support and communications, including emails, text messages, call notes, survey responses, service requests, complaints, and warranty or repair records.

Job-applicant and workforce information if you apply to work with us or perform route, stocking, maintenance, or other services for us.

Information collected automatically

Website and device information, such as IP address, browser type, device identifiers, pages viewed, referring pages, approximate location derived from IP address, and cookie or similar technology data.

Machine and transaction information, such as machine identifier and location, date and time, selected or removed products, transaction amount, payment status or token, refunds, machine access events, inventory levels, temperature, device health, and fault logs.

Camera or sensor information used by certain smart vending machines to determine which products are taken, validate transactions, reduce theft, maintain security, and troubleshoot disputes. Depending on the machine provider and configuration, this may include images, short video, or event data captured in or around the machine.

Important camera notice

VendSteward does not use smart-machine camera data for facial recognition or to identify individuals by facial geometry unless we provide a separate notice and obtain any consent required by law. Before deployment, VendSteward must confirm whether the selected machine vendor stores raw imagery, where it is stored, who can access it, and how long it is retained.

Information from other sources

We may receive information from property owners and location partners, machine owners, manufacturers and software platforms, payment processors, financing providers, lead-generation or advertising partners, public business records, service technicians, and other vendors supporting the Services.

3. How We Use Personal Information

Provide, operate, install, stock, monitor, maintain, and improve the Services.

Process equipment purchases, managed-service arrangements, payments, payouts, refunds, financing referrals, and related records.

Evaluate prospective machine locations, manage inventory and routes, forecast demand, and prepare performance reports.

Authenticate machine access, validate purchases, investigate disputes, prevent theft and fraud, and protect people, property, and systems.

Respond to inquiries, provide customer support, communicate about service issues, and administer warranties or repairs.

Send operational messages and, where permitted, marketing communications. You may opt out of marketing email using the unsubscribe link and marketing texts by replying STOP.

Measure website and campaign performance, personalize content, and conduct analytics, subject to applicable consent and opt-out requirements.

Comply with law, enforce agreements, establish or defend legal claims, and complete corporate transactions.

Create aggregated or deidentified information that is not reasonably capable of being linked to you and use it for lawful purposes.

4. How We Disclose Personal Information

We may disclose personal information to the following recipients for the purposes described above:

Service providers and contractors that provide hosting, cloud storage, CRM, communications, analytics, marketing, customer support, installation, stocking, route management, maintenance, accounting, security, and professional services.

Machine manufacturers and technology platforms that provide smart-machine software, computer-vision transaction processing, telemetry, inventory systems, access controls, and technical support.

Payment processors, banks, financing providers, and insurers involved in purchases, payment processing, equipment financing, payouts, fraud prevention, or risk management.

Machine owners, property owners, and location partners as reasonably necessary to operate a placement, report performance, resolve an incident, or administer contractual obligations. Reports should be limited to information reasonably necessary for the relationship.

Government authorities, law enforcement, courts, regulators, or other parties when required by law or reasonably necessary to protect rights, safety, and security.

A buyer, investor, lender, adviser, or successor in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.

Other parties at your direction or with your consent.

We do not sell personal information for money. If our use of advertising cookies or similar technology constitutes a "sale," "sharing," or targeted advertising under applicable law, you may opt out through [COOKIE PREFERENCE/DO NOT SELL OR SHARE LINK] and by using a recognized opt-out preference signal where required.

5. Cookies, Analytics, and Advertising

We and our vendors may use cookies, pixels, software development kits, and similar technologies to keep the website functioning, remember preferences, understand usage, measure campaigns, and deliver or evaluate advertising. You can manage nonessential technologies through [COOKIE SETTINGS LINK] and adjust browser settings. Blocking some technologies may affect site functionality. Where required, we honor legally recognized browser-based opt-out preference signals, such as Global Privacy Control.

6. Smart Vending Machines and Camera-Assisted Transactions

Certain machines may use cameras, weight sensors, door sensors, or other technology to determine what products are removed and to charge the appropriate payment method. Notices should be displayed at or near each machine when required. Depending on how the program is structured, VendSteward, the machine owner, the location, and the technology provider may have different privacy roles.

Transaction review: authorized personnel or technology providers may review flagged events to verify a charge, investigate a refund, or address suspected fraud or theft.

Security: access to machine imagery and event records is restricted based on job responsibilities and contractual controls.

Retention: transaction records and camera-assisted event data are retained only as long as reasonably necessary for transaction validation, disputes, security, legal compliance, and contractual obligations, according to the final vendor configuration and retention schedule.

Payment data: machine payment credentials may be tokenized and processed by a third-party payment processor. VendSteward generally does not receive complete payment-card numbers.

7. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide Services, maintain business and tax records, administer contracts and warranties, resolve disputes, prevent fraud, and meet legal obligations. Retention varies by record type, sensitivity, legal requirements, and operational need. We will document and apply specific retention periods for website leads, customer and owner records, machine transactions, camera-assisted event data, support records, and workforce records before launch.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, such as access controls, vendor review, encryption where appropriate, logging, and workforce training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, contact us promptly at [PRIVACY EMAIL].

9. Your Privacy Choices

Marketing email: use the unsubscribe link in the message.

Marketing text messages: reply STOP. Message and data rates may apply. Transactional or service messages may continue where permitted.

Cookies and targeted advertising: use [COOKIE SETTINGS LINK] and applicable browser controls.

Access, correction, deletion, portability, or appeal: submit a request using the methods in Section 13. Rights vary by jurisdiction and are subject to legal exceptions.

Authorized agents: where permitted, an authorized agent may submit a request on your behalf. We may require proof of authorization and identity verification.

10. U.S. State Privacy Disclosures

Residents of certain U.S. states may have rights to confirm whether we process personal information; access, correct, delete, or obtain a copy of personal information; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; and appeal a denied request. These rights apply only when the relevant law covers VendSteward and the particular processing activity.

California notice

For California residents, the table below summarizes categories of personal information we may have collected during the preceding 12 months, depending on your relationship with us. We may use and disclose these categories for the business purposes described in Sections 3 and 4.

Category

Examples

Sourc

Identifiers

Name, contact details, IP address, account or device identifiers

You; devices; partners and vendors

Customer records

Contact, account, purchase, financing, and service information

You; payment/financing and service partners

Commercial information

Purchases, equipment interests, transaction and product history

You; machines; owners; locations; vendors

Internet/electronic activity

Website activity, cookies, machine logs, access and telemetry events

Devices; machines; analytics and platform vendors

Geolocation

Approximate IP location and machine/location information

Devices; locations; machine systems

Audio/visual information

Support-call recordings if disclosed; camera-assisted vending event data

You; machines; communications and platform vendors

Professional information

Business role, company, location and applicant/workforce information

You; business contacts; service providers

Inferences

Likely product, location, or service preferences

Derived from activity and transactions

Sensitive information

Account credentials, precise location if enabled, payment or government identifiers when required

You; devices; payment/financing partners

California residents may have the rights to know/access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing when exercising privacy rights. We do not use or disclose sensitive personal information for purposes that require a right to limit unless disclosed otherwise. VendSteward does not knowingly sell or share the personal information of consumers under 16.

California request metrics and additional disclosures will be posted if and when required. California's "Shine the Light" law may also permit certain residents to request information about disclosures for third parties' direct marketing; submit such requests using Section 13.

11. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information online from children under 13. Smart vending machines may be located in places accessible to minors; however, they are intended to process product transactions rather than knowingly create profiles of children. If you believe a child has provided personal information to us, contact [PRIVACY EMAIL].

12. External Links and Third-Party Services

Our Services may link to or integrate with third-party websites, financing applications, payment services, social media platforms, maps, and other services. Their privacy practices are governed by their own notices. Review those notices before providing information.

13. How to Exercise Privacy Rights

To submit a privacy request, contact us through one of the following methods:

Online: [PRIVACY REQUEST URL]

Email: [PRIVACY EMAIL]

Telephone: [PRIVACY REQUEST PHONE, IF APPLICABLE]

Mail: VendSteward Group, Attn: Privacy, [MAILING ADDRESS]

Please describe your request and your relationship with VendSteward. We may verify your identity by matching information you provide with information we maintain and may request additional information when reasonably necessary. We will respond within the time required by applicable law. If we deny a request and your state provides an appeal right, you may appeal by replying to our decision or using [APPEAL METHOD].

14. International Users

VendSteward is based in the United States. If you access the Services from another country, your information may be transferred to and processed in the United States, where privacy laws may differ. Before marketing or providing Services outside the United States, we will update this Policy and implement any required transfer and local-law measures.

15. Changes to This Policy

We may update this Policy periodically. We will post the revised version and change the "Last updated" date. If changes are material, we may provide additional notice as required by law. Your continued use of the Services after the effective date of an updated Policy is subject to the updated Policy, where permitted by law.

16. Contact Us

Questions about this Policy or our privacy practices may be sent to:

[LEGAL ENTITY NAME] d/b/a VendSteward Group
Attn: Privacy
[MAILING ADDRESS]
[PRIVACY EMAIL]
[PHONE NUMBER]

Implementation Notes — Remove Before Publishing

This draft is a business-ready starting point, not legal advice. It must be reconciled with actual contracts, data flows, machine signage, payment and financing systems, cookie tools, marketing practices, and the privacy terms of every manufacturer and platform. In particular, confirm whether the smart-machine vendor processes biometric identifiers, retains raw images or video, transfers data outside the United States, or uses data for model training. Obtain qualified legal review before publication or deployment.

VendSteward Group • Effective September 3, 2026 | Page