Privacy, documented.

This Privacy Policy (the “Policy”) applies to personal information processed by LooksMaxx VC, a Nevada limited liability company (“LooksMaxx VC,” “we,” “us,” or “our”), through looksmaxxvc.com, www.looksmaxxvc.com, guess.looksmaxxvc.com, terms.looksmaxxvc.com, and the related pages, forms, and features covered by our Terms of Use (collectively, the “Services”).

LooksMaxx VC is the controller or operator of the personal information described here, except where a third party independently determines how it processes information. This Policy does not govern a portfolio company, linked website, social network, accelerator, photo host, or other third party. If a separately signed agreement contains a more specific privacy term, that term controls for its subject.

• No accounts or advertising profiles. The current Services do not offer user accounts, advertising, or marketing-email enrollment.
• Applications are private. We store application records in private Vercel Blob storage and limit use to application review, communication, security, and legal administration.
• Guess votes are pseudonymous. A persistent random browser identifier accompanies submitted votes; raw vote records are not public, but aggregate percentages are.
• Analytics are aggregate. Vercel Web Analytics is cookie-free by default and reports page, referrer, coarse location, browser, operating system, and device information in aggregate.
• Public profiles are separate. Guess may display real founder directory facts and portraits received from authorized, licensed, or identified public sources. Player-submitted poll selections are not verified demographic or biometric inferences.
• Rights requests are available. You may contact us for access, correction, deletion, consent withdrawal, or a content/portrait request, subject to verification and applicable law.

The categories below describe information we have collected or may collect through the current Services. Whether a field is required is shown at the point of collection.

We do not ask for Social Security numbers, government identification, bank credentials, medical records, genetic information, precise geolocation, passwords, or payment-card data through the current Services. Please do not submit those items.

We collect information from the following categories of sources:

• You. Information you type into a form, send by email, choose in Guess, or otherwise provide; and images accessible through links you choose to submit.
• Your browser and device. Local-storage identifiers, requests, technical headers, and activity generated when you use the Services.
• Service providers. Hosting, security, analytics, database, and storage providers may return operational or aggregate information about the Services.
• Authorized, licensed, or public sources. Founder directories, licensors, consented rosters, source pages, and people or organizations that provide profile information and rights records.
• Other people. An authorized representative may contact us for a privacy, correction, safety, publicity, or intellectual-property matter.

We use the information described above only as reasonably necessary to:

• provide, maintain, personalize, and troubleshoot the Services;
• receive, review, and respond to an application or communication;
• record a Guess selection and generate pseudonymous crowd aggregates;
• protect people, profiles, rights, the Services, and our infrastructure;
• detect fraud, vote manipulation, malicious activity, and Terms violations;
• measure aggregate traffic and improve usability and performance;
• authenticate and respond to privacy, consent, correction, deletion, or removal requests;
• establish, exercise, or defend legal claims and enforce agreements;
• comply with applicable law, legal process, and lawful government requests; and
• complete a disclosed corporate transaction, subject to applicable protections.

Legal bases where required

Depending on the activity and jurisdiction, we rely on: performance of a contract or steps you request before a potential contract; your consent; our legitimate interests in operating, securing, improving, and administering the Services and submissions; and compliance with legal obligations. Where we rely on consent, you may withdraw it for future processing. Withdrawal does not affect processing already lawfully completed.

We do not use a Guess label or rating, application photo, self-selected tier, or inferred characteristic to make a solely automated decision that produces legal or similarly significant effects about a person.

The first time you submit a Guess vote in a browser, the browser creates a random UUID and saves it in local storage under looksmaxx-fiction-session-v1. When you submit a vote, we receive that UUID, the displayed founder's internal record ID, the label and rating you selected, correctness flags, and a server timestamp. The database does not need your name or email for gameplay.

The session UUID helps distinguish your prior selections from other votes when we create crowd statistics. It is persistent and therefore pseudonymous, not anonymous. Score, streak, and completed-count figures shown during play are held in page memory and normally reset on refresh. Raw votes remain server-side. Public crowd percentages and batch rollups are aggregate statistics and do not display the browser UUID.

The current game has no verified or system-generated correct answer. Crowd percentages derive only from submitted poll selections. We do not analyze the person's photo, name, company, biography, IP address, or a player's vote to infer or verify a real demographic or protected characteristic.

We receive a photograph or photograph link only when an applicant voluntarily submits it for application review, or when a profile source or authorized roster provides a portrait for public display. Application images and profile portraits are handled differently.

Application photos

Application photo URLs and related self-selected appearance information are private application data. Authorized reviewers may open a submitted link and visually review the image for the limited purpose disclosed with the form. We do not use application photos to identify health status, create a facial-geometry identifier template, recognize identity through automated facial recognition, infer race or another protected trait, train a general-purpose AI model, target advertising, or sell data.

Appearance-related information may be treated as sensitive or consumer health data in some circumstances. We apply the additional disclosures and request procedures in our Consumer Health Data Privacy Notice. We ask for a separate opt-in before processing voluntarily submitted appearance material through the application form.

Profile portraits

Guess profile portraits are public-facing content received from an authorized, licensed, or identified public source. We display the image; we do not scan it to derive identity, face geometry, health, ethnicity, or another protected characteristic. If you are depicted or have authority to act for the person, you may request correction or removal using Section 13.

Vercel Web Analytics

We use Vercel Web Analytics to understand aggregate traffic. According to Vercel, its default Web Analytics product uses no third-party advertising cookies, does not associate page views with an individual or IP address in our analytics dashboard, and discards its request-derived visitor session after 24 hours. Data points may include timestamp, page or route, filtered query parameters, referrer, country or city derived from IP, browser, operating system, device type, and analytics script version. Vercel still processes request and IP information operationally as our hosting provider.

You can read Vercel's current product disclosure in its Web Analytics privacy documentation.

Cookies and similar storage

The current Services do not use advertising cookies or an account login cookie. Guess uses browser local storage for the random session UUID described in Section 6. Local storage is not automatically sent with every request; the application sends the UUID when you submit a vote. You can remove it using your browser's clear-site-data controls, which will cause a future vote to use a new UUID.

Operational logs

Vercel hosting and security systems may process IP address, request headers, user agent, route, timestamp, response status, diagnostics, and similar data to deliver requests, detect abuse, maintain reliability, and satisfy legal obligations. We may access logs available to us when needed for those purposes.

We disclose information only to these categories of recipients for the stated purposes:

• Vercel. Hosting, server functions, security, private application Blob storage, public authorized-profile image storage, and aggregate Web Analytics.
• Neon. Managed PostgreSQL storage for founder catalog records, Guess votes, pseudonymous session UUIDs, and crowd aggregates.
• Authorized personnel and contractors. People who need information to review an application, operate the Services, investigate abuse, or respond to a request, subject to role-appropriate duties.
• Professional advisers. Lawyers, accountants, auditors, insurers, and security specialists where reasonably necessary and subject to professional or contractual obligations.
• Authorities and affected parties. Courts, regulators, law enforcement, rights holders, or others when we reasonably believe disclosure is legally required or necessary to protect rights, safety, people, or systems.
• Transaction parties. Actual or prospective parties and advisers to a financing, merger, acquisition, reorganization, bankruptcy, or transfer of all or part of the business, subject to confidentiality and applicable law.
• At your direction. A recipient you expressly authorize or a service you choose to use, such as the host of a submitted photo link.

Crowd percentages and batch summaries are disclosed publicly only in aggregate. Public founder names, roles, companies, batches, source links, and authorized portraits are displayed as profile content, not as applicant or player data.

We do not sell or rent personal information for money. We do not sell consumer health data. We do not “share” personal information for cross-context behavioral advertising, use it for targeted advertising, or disclose it to a data broker. We do not offer a financial incentive or price difference in exchange for personal information.

Nevada's definition of a sale and California and other states' definitions of sale or sharing differ. Under each, our current practices are not a sale or targeted-advertising share. If that changes, we will update this Policy and provide any required notice and opt-out before the new practice begins.

We retain each category only as long as reasonably necessary for the disclosed purpose, taking into account the sensitivity and volume of the data, the duration of an active relationship or review, security needs, user expectations, legal limitation periods, recordkeeping duties, disputes, and whether the information can be aggregated or deidentified. The current systems do not promise automatic deletion on a fixed day.

Deletion from active systems may not immediately remove a record from security archives or backups. Backup copies are isolated from ordinary use and age out or are overwritten according to provider and operational cycles, unless preservation is legally required. Aggregated or deidentified data that cannot reasonably identify you may be retained.

We use administrative, technical, and physical measures designed to protect information in light of its nature and the Services. Current measures include TLS-protected connections, private storage for application JSON, encrypted managed infrastructure, parameterized database queries, restricted server-side credentials, input validation, limited-purpose access, and separation of public aggregate results from raw vote records.

No Internet transmission or storage system is perfectly secure. We cannot guarantee absolute security. You should use an appropriate photo host, avoid putting secrets in a URL, and contact us if you believe information or the Services have been compromised.

Depending on where you live and the context, you may have the right to confirm whether we process your information; access it; correct it; delete it; receive a portable copy; withdraw consent; obtain categories or a list of recipients; opt out of sale, targeted advertising, or certain profiling; restrict or object to processing; or appeal a refusal. You may also request correction or removal of a profile or portrait that concerns you.

How to submit a request

Email looksmaxxvc@gmail.com with the subject “Privacy Request.” Describe the right you want to exercise, the Service involved, your state or country, and the information needed to locate the record. For Guess data, include the session UUID if available. For a profile request, include the exact page and your relationship to the person depicted.

We will use information reasonably necessary to verify the request and your authority. We will not ask for unrelated sensitive information. An authorized agent may submit a request where applicable, but we may require proof of authority and direct verification with the person. We generally respond within 45 days after verification or within the period required by law, and will explain any permitted extension or denial.

Appeals and nondiscrimination

To appeal a refusal, reply to our decision or email the same address with the subject “Privacy Appeal” and explain why you believe the decision should change. We will respond within the time required by applicable law and, where required, provide regulator contact information. We will not unlawfully discriminate against you for exercising a privacy right. A valid deletion or consent-withdrawal request may prevent us from continuing a feature that requires the affected information.

California notice at collection and privacy disclosure

The categories collected during the preceding 12 months are the categories in Section 3: identifiers; professional or application information; Internet or network activity; inferences or self-selected tier information in an appearance-related context; submitted photo links and images; communications; and public-source profile information. We use them for the category-specific purposes in Sections 3 and 5 and retain them using the criteria in Section 11. We disclose relevant categories for business purposes to the recipient categories in Section 9. We do not sell or share these categories for cross-context behavioral advertising and have not done so during the preceding 12 months.

We do not use or disclose sensitive personal information to infer characteristics or for purposes outside those permitted by California law. We do not knowingly sell or share the personal information of consumers under 16. California residents may request access to categories and specific pieces, correction, deletion, portability, and information about sources, purposes, and recipients, subject to exceptions. We do not provide a “Limit the Use of My Sensitive Personal Information” link because our disclosed use is limited to requested services, security, and other permitted purposes.

California's “Shine the Light” law may permit residents to ask about disclosure of personal information to third parties for their direct-marketing purposes. We do not make such disclosures. California's Online Privacy Protection Act disclosures about tracking are in Sections 8 and 17.

Nevada

Nevada residents may submit a verified direction not to make a covered sale through our designated request address, looksmaxxvc@gmail.com. We do not currently make covered sales. The collected categories, recipient categories, review and correction process, material-change process, cross-site-collection disclosure, and effective date required by Nevada law appear in Sections 3, 9, 13, 17, 19, and 20.

Other U.S. states

Residents of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, and other states with applicable comprehensive privacy laws may exercise the rights available under their law using Section 13. We honor a legally recognized universal opt-out signal for a covered sale or targeted advertising; because we do neither, the signal does not currently change how the Services operate.

The Company and Services are based in the United States. Information may be processed in the United States and other locations where our providers operate. Those locations may have different data-protection laws than your home jurisdiction. Where required, we rely on an adequacy decision, contractual safeguards, consent, or another lawful transfer mechanism.

If the GDPR, U.K. GDPR, or a similar law applies, the legal bases in Section 5 apply. You may have rights to access, correction, deletion, portability, restriction, objection, and consent withdrawal, plus the right to complain to your local supervisory authority. Our legitimate interests include securely operating the Services, responding to requested applications, preserving game integrity, protecting rights, and improving aggregate performance; we balance those interests against affected rights.

The Services are not presently directed to people outside the United States or offered as a regulated service in the European Economic Area, United Kingdom, or Switzerland. If local law requires a representative or additional disclosure for a processing activity, that activity will not begin until the requirement is addressed.

The Services are for adults 18 and older. We do not knowingly collect an application, photo, or game submission from a child under 13 or knowingly accept an application from anyone under 18. Do not submit an image of a minor. If you believe a minor has provided personal information, contact us so we can investigate and delete it as appropriate.

Browser “Do Not Track” signals do not have one universally accepted technical or legal meaning, so the Services do not alter their first-party local-storage, security, or aggregate analytics behavior in response to DNT alone. We do not permit an advertising network to build a profile of your activity across unrelated websites through the Services. Vercel acts as our provider and states that its Web Analytics does not track an end user across different applications or websites.

We treat Global Privacy Control or another legally recognized universal opt-out mechanism as a request to opt out of covered sales and targeted advertising where required. Since we do not currently engage in those practices, there is no sale or targeted-advertising setting for the signal to change.

A source link, social link, photo-hosting link, accelerator directory, or other external destination has its own privacy practices. We do not control what that third party collects when you visit it. If you submit a photo URL, the photo host may log a request when an authorized reviewer opens it. Review the host's settings and privacy notice before submitting a link, and do not place credentials or unrelated personal information in the URL.

We may update this Policy prospectively to reflect legal, technical, or business changes. We will post the revised version with a new effective date and provide a conspicuous notice through the Services when a change is material. If a change would materially expand the categories or purposes for which we process voluntarily submitted photos, consumer health data, or other sensitive information, we will obtain new consent where required before applying that change to affected information.

Send privacy questions, requests, complaints, appeals, consent withdrawals, and profile or portrait concerns to looksmaxxvc@gmail.com. This email address is also our designated request address for Nevada online-privacy requests. Use a descriptive subject line and do not send identity documents unless we specifically request a secure verification method.

Effective date: August 27, 2026