Privacy Policy — China Addendum

Personal Information Protection Law (PIPL) Supplement

This addendum applies to users located in the People's Republic of China and supplements our main Privacy Policy. Where this addendum conflicts with the main Privacy Policy, this addendum prevails for users in China.

---

1. Cross-Border Data Transfer

Your personal information is transferred to and stored in Singapore, where our servers are located. This transfer is necessary to provide you with the Cardie service.

Before your data is transferred outside of China, we inform you of the following as required by the Personal Information Protection Law:

Name of overseas recipient: Mapraow Labs Pte. Ltd. Contact: privacy@cardie.golf Location: Singapore

Categories of personal information transferred: Account information (name, email), scorecard photos, golf scores and statistics, handicap rating basis preference, social interaction data (reactions, views, and invitations), location data (if enabled), device and service reliability information, and usage analytics (if enabled).

Purpose of transfer: To provide the Cardie service — storing your account and round data, processing scorecard images, calculating your handicap, operating community and social features (groups, events, reactions, views), generating AI-powered round narratives, and managing your subscription.

Method of transfer: Encrypted transmission over secure internet protocols (TLS/SSL).

How to exercise your rights with the overseas recipient: Contact privacy@cardie.golf to exercise any right described in this policy, including access, correction, deletion, and data portability. We will respond within 30 days.

Safeguards: We have implemented standard contractual clauses and technical measures (encryption in transit and at rest, access controls, row-level security) to protect your personal information during and after transfer.

Your separate consent for this cross-border transfer is obtained during the App's onboarding process. You may withdraw this consent at any time by deleting your account, as the cross-border transfer is necessary for the service to function.

---

2. Your Rights Under PIPL

In addition to the rights described in our main Privacy Policy, you have the following rights under the Personal Information Protection Law:

Right to be informed — You have the right to know how your personal information is collected, used, stored, and shared. This policy and addendum serve as that notice.

Right to restrict or refuse processing — You may restrict or refuse the processing of your personal information, except where processing is required by law or necessary to perform a contract with you.

Right to request explanation — You may request an explanation of the rules we apply to the processing of your personal information.

Right to request deletion — You may request deletion of your personal information. We will process deletion requests within 30 days. You can initiate deletion directly in the App under account settings. A 30-day grace period applies during which you can cancel the deletion by signing back in.

Right to portability — You may request a copy of your personal information in a structured, commonly used format.

Right of deceased persons — The close relatives of a deceased user may exercise the above rights with respect to the deceased user's personal information, unless the deceased user made other arrangements during their lifetime.

To exercise any of these rights, contact us at privacy@cardie.golf.

---

3. Sensitive Personal Information

Under PIPL, certain categories of personal information receive additional protection. Of the data Cardie collects:

Location data is classified as sensitive personal information. We collect location data only with your separate, explicit consent and only for the specific purpose of identifying your golf course and retrieving weather conditions. You may decline location data collection and the App will function normally — you will select your course manually.

Scorecard photos contain handwriting. While handwriting is not biometric data (we do not use it to identify you), we treat scorecard images with care and process them only for the stated purposes of score extraction and handicap verification.

Your handicap rating basis preference (men's or women's course ratings) is a functional calculation setting used to determine which rating table applies to your handicap. It is not biometric data, health data, or data revealing religious beliefs, and does not fall within the categories of sensitive personal information under PIPL.

---

4. Automated Decision-Making

Cardie uses automated processing to extract scores from scorecard photos, to calculate your handicap index, and to generate AI-powered narrative recaps of your rounds. These automated processes do not make decisions that have significant effects on your rights or interests. You always have the opportunity to review and correct extracted scores before they are saved.

---

5. Local Representative

If required by applicable regulation based on the volume of Chinese users, we will designate a local representative in China and update this addendum with their contact information.

---

6. Contact

For questions about this addendum or to exercise your rights under PIPL:

Email: privacy@cardie.golf Entity: Mapraow Labs Pte. Ltd., Singapore

---

This addendum is provided in English and Chinese. In case of conflict, the English version governs.