Effective Date: March 9th 2026

This Privacy Policy of Even Try On App ( or the “Application”) explains how we collect, use, store, disclose, and share (collectively “process”) your personal data when you Even Try On App to create 3D models of your facial features. We respect your privacy and will take security protection measures to protect your personal data. If you use the Application in combination with any third party application or services, please note that you are providing information directly to the third party subject to the third party’s privacy policy. Please read their data usage policies or other documentation. Our linking to another site or service doesn’t mean we endorse that third party.

In this Policy “Even Realities”, “we”, “us” or “our” refers to Even Realities GmbH, a company registered in Berlin with its registered address located at Friedrichstraße 79, 10117 Berlin, Germany if you are accessing the Services within EEA and within the United States.

This Policy may be updated from time to time and therefore please check back periodically for the latest version of the Policy as indicated below. If there will be any significant changes made to the use of your personal data in a manner different from that stated at the time of collection, we will notify you by sending e-mail, posting a notice on our App or by other means.

Here is a summary of the information contained in this Policy. This summary is to help you navigate the Policy and it is not a substitute for reading everything. You can view the particular sections for more detailed information.

What data do we collect about you? If you use Even Try On, we will collect your facial information and other personal information. For more information, please refer to 1. What data do we collect about you.

How do we use your data? We process your personal data to optimize your eyewear experience. For more information, please refer to 2. How do we use your data?

How do we retain your data? We will store your personal data with appropriate safeguards and take every reasonable step to ensure that your personal data is only processed for the minimum period necessary for the purposes set out in this Policy. For more details on the location and duration of the retention of your personal data, please refer to 3. How do we retain and protect your data?

How will we disclose and transfer your data globally? We may disclose your personal data to affiliates and some third-party service providers (e.g., technology services and business support) who help us deliver the relevant services. We may also be required to disclose certain personal data about you in response to any legal procedures or requests from regulatory authorities for audit purposes, in the event of mergers, acquisitions, sale of assets, or transfer of services, and in other circumstances specified under 4. How will we disclose your data. Due to the international operation of our business, your personal data may be accessed from and transferred to jurisdictions outside of where you are located. In the event of a cross-border transfer of personal data, we take appropriate measures to provide an adequate level of protection for your personal data. For more information, please refer to 5. How will we transfer your data around the world.

What are your rights regarding the processing of your personal data? Depending on where you are, you may have certain rights with respect to your personal data, such as rights of access and data portability, to correct or delete your personal data, to withdraw your consent, restrict or object to our processing of your personal data, or to lodge complaints with an applicable authority for any breach of data protection laws. For more information, please refer to 6. What are your data subject rights and choices? In particular, if you are a California resident, certain state data privacy legislations may entitle you to additional rights as detailed under 8. Notice to California Residents.

How do we protect minors? We do not aim to provide Services for minors and we do not intentionally collect or maintain information from minors. For more information, please refer to 7. How do we protect minors?

Contact Us. If you have any questions or comments regarding this Policy and/or other privacy practices, want to exercise any rights you may have, please contact us by using the information detailed under 10. How to contact us.

1. What data do we collect about you?

For the purpose of this Policy “personal data” means any information relating to an identified or identifiable individual. To the extent that our processing of your personal data is subject to certain data privacy protection laws (including but not limited to the General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act as amended in 2020 (“CCPA”), collectively hereafter “applicable laws”), we will also notify you about the legal basis on which we process your personal data and your rights under such laws.

We collect the following categories of personal data from you:

Facial Data: If you use Even Try On App, you may generate facial 3D images and structured facial 3D modeling data based on the mobile device you are using. The generated images will be stored in the local device storage location you have selected. Even Realities dose not have the authority to directly collect your Facial Data through the Application. We will only collect Facial Data information provided by you when you share such data with Even Realities Support in accordance with “Even Try On” App User Guide.

Contact Information: If you share your data with us in accordance with the “Even Try On” App User Guide, we will process the email information you send to us, including your email address, email content, email attachments, sender and recipient information, and other information contained in the email.

Access permission which we can request

During your use of Even Try On App, the Application will access the main device permissions as follows:

(i) Permission to Camera

(ii) Permission Files and Folders

You can choose to disable part of or all permissions in the device settings. Disabling will affect the corresponding function. The way permissions are displayed and disabled may vary on different devices. Please refer to the instructions or guidelines provided by the device and system developers for information on how to disable permissions.

2. How do we use your data?

We will only use your personal data when the applicable laws allow us to. Our legal bases for collecting and using the personal information depends on the personal data we collect and the specific context in which we collect the information. The purposes for which we process personal data subject to applicable laws and the legal basis on which we perform such processing are as follows:

3. How do we retain and protect your data?

Where would we keep your data

If you share your information with us, your data will be processed by Even Realities Support Team located in various regions, provided that appropriate safeguards are in place. Additionally, as we may utilize third-party infrastructure or support systems for basic business operations, such as cloud infrastructure providers, your data may be stored on the servers of such third party service providers. In such cases, we will select trusted third parties that meet industry standards and possess data security capabilities.

How long do we store your data

We adhere to retention policies for the personal data we collect to ensure that it is not retained longer than necessary for the intended purpose. Different retention periods are applied to the various types of personal data collected by us in accordance with the service needs and regulatory requirements.

Upon expiration of the retention period, we will either delete or anonymize your personal data. Measures will be taken to render the information irrecoverable or irreproducible.

When assessing how long your personal data is retained, we consider criteria such as: (i) the nature of the personal data and the activities involved; (ii) when and for how long you use the Products; and (iii) our legitimate interests and our legal obligations.

How do we protect your data

Before sharing with Even Realities, your Facial Data generated with Even Try On is encrypted and stored locally on the device only. When you share the Facial Data with us via email, we will implement appropriate technical and organizational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and other unlawful or unauthorized forms of processing in accordance with applicable laws. For example, where the purpose of processing of specific data is not related to after-sales supports for any specific individual, we will process the relevant data by means such as de-identification, aggregation, and clustering to ensure that individuals cannot be identified in the specific data processing context.

Please note the Internet is an open system, the transmission of information via the internet is not completely secure. Although we will implement all reasonable measures to protect your personal data, we cannot guarantee the security of your data transmitted to us using the internet – any such transmission is at your own risk and you are responsible for ensuring that any personal data that you send to us are sent securely.

4. How will we disclose your data?

In order to provide you with more comprehensive Products and Services, we will authorize our commercial partners to provide certain services to you. In such cases, we may share some of your personal data with these partners.

We will only share your personal data for lawful, legitimate, necessary, specific, and explicit purposes and we will only share the personal data required to provide the Services. We will require our partners through agreements to retain data only for the necessary period and to implement adequate security measures to protect data security.

We will disclose personal data to the following categories of third parties for the purposes explained in this Policy:

Affiliates and corporate partners: We disclose the categories of personal data described above between and among our affiliates and related entities for legitimate business purposes and the operation of the Services in accordance with applicable laws.

Service providers and business partners: Third-party service providers who provide us with technology services, such as cloud storage service, email systems, and other collaboration software. These third parties will process your personal data on our behalf under relevant contracts.

Law enforcement agencies, public authorities, or other judicial bodies and organizations: We disclose Information if we are legally required to do so or if we have a good faith belief that such use is reasonably necessary to comply with a legal obligation, process, or request; enforce our Terms of Service and other terms, policies, and standards, including investigation of any potential violation thereof; detect, prevent, or otherwise address security, fraud, or technical issues; or protect the rights, property, or safety of us, our users, a third party, or the public as required or permitted by applicable laws (including exchanging information with other companies and organizations for the purposes of fraud protection).

Change of corporate ownership: If we are involved in a merger, acquisition, bankruptcy, reorganization, partnership, asset sale, or other transaction, we may disclose your Information as part of that transaction.

5. How will we transfer your data around the world?

Given the global scope of our business operations, your personal data may be processed on servers located outside of the country where you reside. Meanwhile, due to the international nature of our business, your personal data may also be accessed by our affiliates or be transferred to third-party service providers and business partners in connection with the purposes set out in this Policy. For this reason, we transfer personal data to other jurisdictions that may have different laws and data protection compliance requirements to those that apply in the jurisdiction in which you are located.

In the event of an international transfer of personal data, when required by applicable laws, we will provide an adequate level of protection for your personal data using various means including where appropriate implementing the European Commission approved Standard Contractual Clauses and UK International Data Transfer Agreement between our affiliates and third parties (where applicable) or any other lawful approach that permits the lawful transfer of personal data from those countries.

6. What are your data subject rights and choices?

Subject to applicable law and depending on where you reside, you may have some rights regarding your personal data as described further below. You may exercise some of your rights in accordance with Section 10. If you have any other requests relating to access to your personal data, please contact us.

Data Access

You may have the right to know what personal data we process about you, including the categories of personal data, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it.

Data Correction

You may have the right to request that we correct inaccurate personal data that we retain about you, subject to certain exceptions.

Data Portability

You may contact us to request the personal data you have provided to us in a structured, commonly used, and machine-readable format and have it transferred to another controller to the extent applicable.

Data Deletion

You have the right to delete your account and erase your personal data. Upon deleting your account, all your personal data will be deleted. Additionally, you may also request deletion of the personal data you provide by contacting us. If some of your personal data cannot be deleted, we will inform you of the reasons for not taking action.

Please note that we reserve the right to retain some of your personal data where there are valid grounds for us to do so under applicable laws. If you would like to request the deletion of your data from our systems, please contact us at support@evenrealities.com or contact us from the Services within the Even Realities App. We will make every reasonable effort to fulfill your request in accordance with applicable data protection laws. Certain data may be retained for a period required by law, our legitimate business purposes, or as necessary to fulfill contractual obligations. We may retain anonymized or aggregated data that does not personally identify you for analytical and reporting purposes. We will notify you once your data deletion request is processed. If there are any challenges or exceptional circumstances that may affect the processing time, we will communicate these issues to you promptly.

Withdrawal of Consent

Where we process your personal data on the basis of your consent, you may withdraw your consent by contacting us. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Objection to the Processing

Subject to applicable laws, you may object to the processing of your personal data based on our legitimate interests where there are grounds relating to your particular situation by contacting us. Please note that we may have an overriding legitimate interest to keep processing your personal data, but we will let you know where this is the case.

Restriction to the Processing

If you would like to restrict our processing of your personal data, you may contact us. You have the right to restrict the processing of your data where one of the following applies:

(i) the processing is unlawful and you oppose the erasure of relevant personal data;

(ii) for the purpose of establishment, exercise, or defense of legal claims, you request us to retain your personal data that we were supposed to delete;

(iii) your objection regarding the accuracy of your personal data is pending our verification;

(vi) your request to object to the processing of your personal data is pending our verification.

Other Rights

Depending on your jurisdiction, you may be entitled to additional rights in relation to your personal data. For example, you may also have the right to lodge complaints with an applicable data protection authority if you consider that the processing of your personal data infringes any applicable data protection laws (for example the EU General Data Protection Regulation). For California residents, please find more details of your rights in Section 8 below.

If you would like to contact us to exercise one or more of these rights, to ask a question about these rights or any other provision of this Policy, or about our processing of your personal data, or to file a complaint about how we process your personal data, you may use the contact details provided in Section 9 below. When submitting a right request, please specify the scope and basis of your request and provide us with the necessary information to verify your identity. We may contact you to confirm your identity in order to handle your request. We will respond to your request or complaint in due course under applicable data protection laws.

7. How do we protect minors?

Our Services are not directed towards and we do not knowingly collect, sell, or share any information about children. If you become aware that a child has provided any personal data to us while using our Services, please email us at the contact details provided in Section 9 below and we will investigate the matter and if appropriate delete the personal data.

8. Notice to California Residents

If you are a California resident, the California Privacy Rights Act or other California privacy laws described below require us to provide you with the following additional information:

Collection and Use of Your Personal Data

We collect personal data from and about you in the preceding 12 months as described in Section 1 above.

Disclosure of Personal Data

We disclose personal data with third parties for business purposes in the preceding 12 months as below:

Your California Rights and Choices

As a California resident, you may be able to exercise the following rights:

(i) the right to know any or all of the following information relating to your personal data we have collected and disclosed in the last 12 months upon verification of your identity:

(a) The specific pieces of personal data we have collected about you

(b) The categories of personal data we have collected about you

(c) The categories of sources of the personal data

(d) The categories of personal data that we have disclosed to third parties for a business purpose and the categories of recipients to whom this information was disclosed

(e) The categories of personal data we have sold and the categories of third parties to whom the information was sold

(f) The business or commercial purposes for collecting or selling personal data.

(ii) the right to correct any inaccurate personal data we have about you.

(iii) the right to request deletion of personal data we have collected from you subject to certain exceptions.

(iv) the right to opt-out of the sale and/or the sharing of your personal data and sensitive personal data to third parties now or in the future.

You also have the right to be free of discrimination for exercising these rights. However, please note that the exercise of these rights may limit our ability to process personal data. For example, if you submit a deletion request, we may no longer be able to provide you with our Services.

Limit the Use of Sensitive Personal Data

You also have the right to request limitation of use and disclosure of your sensitive personal data subject to certain exceptions. If you would like to limit the use of your sensitive personal data, please contact us by using the contact details provided in Section 10 below.

The location, biometric information, and verification code are sensitive personal data as defined by the CPRA. Currently, we use and disclose such data to third-party service providers for the purpose necessary to provide Services to you, supporting your account management, calculating the parameters for your Even Realities smart glasses, enabling the functions of Even Realities smart glasses including navigation, real-time translation. We do not “sell” or “share” (as defined under the CPRA) your sensitive personal data.

Do Not Sell or Share My Personal Data

Based on the definition of “sell” and “share” under the CPRA, we do not believe that we engage in such activity and have not engaged in such activity in the past 12 months from the effective date of this Policy.

To submit your California Consumer Rights Requests

You may submit a request to exercise your California Consumer Rights by contacting us using the contact details provided in Section 9 below. We will need to verify your identity before processing your request, which may require us to request additional personal data from you or require you to log into your account if you have one. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law. Subject to certain restrictions, you can have an agent exercise your rights for you. If you have an agent exercising your rights, we must be provided with your written authorization allowing that person to make such a request on your behalf. We reserve the right to deny the agent’s request if we are not reasonably able to confirm proper authorization and/or verify your identity as the requestor.

Appeal

You may appeal our refusal to take action on a request by contacting us using the contact details provided in Section 9 below. If your appeal is denied and you are a California resident, you may contact the California Attorney General about the results of the appeal by submitting a complaint by clicking here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company.

California’s “Shine the Light” Law

California’s “Shine the Light” law (Civil Code Section §1798.83) provides certain rights to California residents who have an established business relationship with us with regard to the disclosure of certain types of personal data to third parties for their direct marketing purposes. We do not disclose personal data to third parties for their direct marketing purposes.

9. HIPAA COMPLIANCE [US Only]

We do not provide medical care or advise and are thus not a Covered Entity under HIPAA (US Health Insurance Portability and Accountability Act) (“HIPAA”).

However, in respect of the health data of our US-based customers, we strive to comply with all of the requirements as per HIPAA.

10. How to contact us?

For more information about your data subject rights or how we process your personal data, please contact us by using the information below.

Controller: Even Realities GmbH

Contact Details: Friedrichstraße 79, 10117 Berlin, Germany

Website: evenrealities.com

Email: support@evenrealities.com

Data Protection Officer: privacy@evenrealities.com

Phone: +49 30 837 90777

11. How do we update this Policy?

We will update this Policy in a timely manner. If there are any substantial changes to this Policy, depending on the nature of such changes, we will notify you in advance through pop-ups, push notifications, emails, and other appropriate means. We recommend that you regularly check the latest version of this Policy upon receiving of any update notifications.