Privacy Policy

We collect personal information directly from you, automatically through your use of the Platform, from third-party sources, and from publicly available materials. The categories of information we collect depend on how you interact with the Platform and your role as an Instructor, Hiring Partner, or visitor.

I. Information You Provide Directly.

A. Account Registration and Profile Information. When you create an account on the Platform, we collect information necessary to establish and maintain your account, including:

1. Instructors: Full legal name, email address, telephone number, professional credentials (certifications, training programs, specializations), employment history (studios, gyms, wellness facilities, retreat centers, brands), engagement history (events, workshops, retreats), insurance status and carrier information, professional biography, headshot or profile photograph, and any other information you choose to submit through your instructor profile.

2. Hiring Partners: Entity name, business address, authorized representative name and contact information, industry or facility type, and billing and payment information as required under separate written agreements.

3. All Users: Username, password, and any other information required to establish your account and verify your identity.

4. Sign-In Services (Auth0 and Google). We use Auth0 to authenticate users. If you choose Google sign-in, we receive your Google account identifier, name, email address and profile photo through Auth0. We use this information to sign you in, maintain your account and help you set up your profile.

B. Verification Data. Instructors who opt in to the Platform's verification process authorize us to collect, verify, and display Verification Data, which includes:

1. Instructor authored profile content, including descriptions of certifications, employment history, retreat and event participation, training programs, brand collaborations, and professional accomplishments.

2. Attestations, confirmations, or statements provided by third-party certification bodies, event or retreat organizers, studios, wellness facilities, or other issuers regarding your credentials, engagements, or qualifications. Such attestations are displayed as the statements of the issuing entity and are not independently verified, investigated, or endorsed by DreamFit Collective.

3. Insurance status information submitted by you or attested by your insurance carrier, including carrier name, policy type, coverage dates, and policy status.

C. Communications and Correspondence. When you contact us via email, Platform messaging, customer support channels, or other means, we collect the contents of your messages, your contact information, and any attachments or other materials you provide.

D. Feedback and User-Generated Content. We collect any comments, suggestions, ideas, feedback, or other content you voluntarily submit to us regarding the Platform or our services.

E. Payment and Billing Information. If applicable based on your role, we collect payment card information, billing address, and related financial information necessary to process fees or payments. Payment processing is handled by third-party payment processors, and we do not store complete payment card numbers on our servers.

I.A.Not Yet a Member (Pre‑Outreach Records)

A.Internal Records from Public Sources. We may assemble internal records from publicly available sources (for example, class schedules, certification registries, or event listings) about professionals we have not yet invited to join the Platform. These internal records help us identify and invite qualified professionals to participate. These records are internal only and are not shown to Hiring Partners or any third party unless and until the professional opts in, completes verification, and becomes a Verified Instructor.

B.Correction or Removal Without an Account. Any individual who is not a Platform user may request correction or removal of these internal records without creating an account by emailing legal@joindreamfit.com. We will respond within the time period required by applicable law.

II. Information Collected Automatically.

A. Usage Data. We automatically collect information about your interactions with the Platform, including:

1. Pages or screens viewed, links clicked, search queries entered, and features accessed.

2. Date and time of your visits, session duration, and frequency of use.

3. Referring and exit pages and URLs.

B. Device and Technical Information. We collect technical information about the devices and software you use to access the Platform, including:

1. Internet Protocol (IP) address, device identifiers (such as MAC address or mobile device ID), and browser type and version.

2. Operating system, device type (desktop, mobile, tablet), screen resolution, and language preferences.

3. Internet service provider and mobile carrier information.

C. Location Information. We may collect general location information derived from your IP address for security and basic localization purposes. If you allow location access in your browser, we use your device’s latitude and longitude to identify your city and help you select your profile location. Mapbox and Google Places process these coordinates to provide that lookup. You can decline location access and search for your city manually.

D. Cookies and Tracking Technologies. We and our third-party service providers use cookies, web beacons, pixels, and similar tracking technologies to collect information about your use of the Platform. For more information about our use of cookies and your choices, see Article 7 below.

III. Information from Third-Party Sources.

A. Public Source Data. We may collect information from publicly available sources, including:

1. Class schedules published by studios, gyms, wellness facilities, or other venues.

2. Publicly accessible certification registries maintained by credential-issuing organizations.

3. Event listings, retreat schedules, workshop announcements, and similar publicly available materials.

4. Professional profiles published on publicly accessible websites or directories.

Public Source Data is used internally to supplement and cross-check Instructor-provided information and to identify potential Instructors to invite to join the Platform. Public Source Data is not used as the system of record for Verification Data and is not presented to Hiring Partners as DreamFit Collective's verification of any Instructor.

B. Third-Party API Data. We obtain data through licensed third-party application programming interfaces (APIs), including: Instagram and YouTube audience data (follower counts, engagement metrics, audience demographics, and related publicly available metrics) obtained through licensed third-party data providers.

We receive Instagram data directly from Meta only after you authorize the connection through Instagram. Separately, we may already hold public Instagram profile and content information obtained through licensed data providers, including Modash, before you join the Platform. That independently sourced information does not depend on connecting Instagram. Instagram audience and engagement statistics may be shown to you and to authorized DreamFit personnel. You control whether social statistics appear on your published Passport, where Hiring Partners and other visitors may see them. The public visibility control applies to statistics from both Meta and our licensed data provider, Modash. Statistics are attributed to their source and identify the available reporting period and recording or capture date; a Modash recording date does not necessarily indicate when Modash measured the statistic. These are descriptive metrics, not a DreamFit Collective evaluation, score, ranking, or opinion.

Where we use Modash to look up an Instagram account, we send the submitted or connected Instagram username to Modash to find public profile information, collaborations and available audience or engagement statistics. We do not send Instagram access tokens or the Insights data received directly from Meta to Modash. Direct connections to Meta are described in Article 11.

C. Attestations from Third-Party Issuers and Venues. With your authorization, we may facilitate the collection and display of attestations or confirmations from certification bodies, event organizers, studios, wellness facilities, retreat centers, or other third-party issuers regarding your credentials, employment, engagements, or qualifications. These attestations are displayed as the issuer's or venue's own statements and are not independently verified, investigated, or endorsed by DreamFit Collective.

D. Connected Social Accounts. If you choose to connect your Instagram account to the Platform, we receive information directly from Meta Platforms through official APIs with your authorization, as described in Article 11 (Connected Social Accounts).

IV. Information We Do Not Collect.

A. Sensitive Personal Information. We do not knowingly request Social Security numbers, driver's license numbers, financial account numbers other than information necessary for payment processing handled by third-party processors, medical records, health information subject to the Health Insurance Portability and Accountability Act (HIPAA), or other categories of sensitive personal information. If you voluntarily provide such information, we may collect it as part of the material you submit.

B. Children's Information. The Platform is not directed to individuals under the age of eighteen (18), and we do not knowingly collect personal information from individuals under eighteen. If we learn that we have collected personal information from an individual under eighteen without any consent required by applicable law, we will take steps to delete such information promptly. If you believe we have collected information from an individual under eighteen, please contact us at legal@joindreamfit.com.

We use the personal information we collect for the purposes described below. Our use of your information is based on your consent, our legitimate business interests, the necessity of processing to perform our contract with you, and compliance with legal obligations.

I. To Provide and Operate the Platform.

A. To create, maintain, and manage your account and provide you with access to the Platform's features and functionality.

B. To verify Instructor identities and eligibility to join the Platform's closed professional network.

C. To host, display, and share Verified Instructor profiles with contracted Hiring Partners through the Platform's closed network, in accordance with Instructors' authorizations and the Terms.

D. To facilitate search and messaging functionality enabling Hiring Partners to identify and initiate contact with Instructors.

E. To process payments, fees, and transactions as applicable.

F. To provide customer support and respond to your inquiries, requests, and feedback.

II. To Verify and Display Information.

A. To collect, verify, and display Verification Data as authorized by Instructors, including instructor-authored profile content and issuer or venue attestations.

B. To use Public Source Data internally to supplement and cross-check Instructor-provided information and to maintain the quality and integrity of the Platform's network.

C. To obtain and process API Data in accordance with your consent and the terms of our third-party API licenses.

D. To assemble internal records from Public Source Data and other available information prior to contacting potential Instructors to invite them to join the Platform. Such internal records are not shared with Hiring Partners or any third party unless and until the Instructor opts in, completes verification, and becomes a Verified Instructor.

III. To Communicate with You.

A. To send you transactional and service related communications, including account confirmations, password resets, verification requests, profile updates, technical notices, security alerts, and administrative messages.

B. To deliver messages from Hiring Partners who have initiated contact with you through the Platform's messaging functionality.

C. To send you marketing and promotional communications about new features, services, events, or opportunities, provided you have consented to receive such communications or we have another lawful basis to send them. You may opt out of marketing communications as described in Article 8 below.

D. To respond to your comments, questions, feedback, or requests for support.

IV. To Improve and Enhance the Platform.

A. To analyze usage patterns, trends, and preferences in order to understand how Users interact with the Platform and to improve its features, functionality, and user experience.

B. To conduct research, testing, and development of new products, services, and features.

C. To troubleshoot technical issues, diagnose problems, and maintain the security and integrity of the Platform.

V. To Protect Our Rights and Comply with Legal Obligations.

A. To enforce our Terms, this Policy, and other agreements and policies governing your use of the Platform.

B. To detect, prevent, and investigate fraud, security incidents, abuse, violations of our policies, and other harmful or illegal activity.

C. To comply with applicable laws, regulations, legal processes, and governmental requests, including responding to subpoenas, court orders, or other lawful demands for information.

D. To protect the rights, property, safety, and security of DreamFit Collective, our Users, and the public.

VI. With Your Consent or at Your Direction.

A. We may use your information for additional purposes with your express consent or at your direction, including to display your profile to Hiring Partners or to include third-party API Data in your profile.

We share your personal information only as described in this Policy. We do not sell or rent your personal information. We may disclose personal information to service providers for analytics, communications, hosting, and other operational support as described below, subject to applicable law and your available choices.

I. Sharing with Hiring Partners.

A. Verified Instructor Profiles. When you opt in to the Platform's verification process and become a Verified Instructor, we share your Verified Instructor profile with contracted Hiring Partners through the Platform's closed network. Access is limited to Hiring Partners who have entered into separate written agreements with DreamFit Collective and is provided solely for hiring, engagement, and related business purposes as authorized by those agreements.

B. Scope of Access. Hiring Partners may search Verified Instructor profiles and initiate messages to Instructors through the Platform. We do not furnish candidate reports, investigative consumer reports, compiled dossiers, scores, rankings, reliability indicators, or other evaluative outputs to Hiring Partners. Instructors who have not opted in or completed verification remain invisible to Hiring Partners, and we do not share internal-only records or pre-outreach data with Hiring Partners.

C. Hiring Partner Confidentiality Obligations. Hiring Partners are contractually obligated to maintain the confidentiality of all profile content, to use access solely for legitimate hiring and engagement purposes, and not to reproduce, redistribute, resell, publicly display, or disclose profile content to any third party without express written consent. Hiring Partners are prohibited from using Platform content as or in lieu of a consumer report or investigative consumer report.

II. Service Providers and Third-Party Partners.

A. We engage third-party service providers to perform functions on our behalf and to support the operation of the Platform, including:

1. Cloud hosting and data storage providers.

2. Payment processors and billing service providers.

3. Email delivery and communication services.

4. Customer support and help desk platforms.

5. Analytics service providers, including Google Analytics.

6. Security, fraud prevention, and identity verification services.

7. API data providers, including for Instagram and YouTube audience data.

B. These service providers are authorized to access and use your personal information only as necessary to perform services on our behalf and are contractually obligated to maintain the confidentiality and security of your information and to use it only for the purposes for which it was disclosed.

III. Attestation Issuers and Venues.

A. With your authorization, we may share limited information with certification bodies, event or retreat organizers, studios, wellness facilities, or other third-party issuers for the purpose of obtaining attestations or confirmations regarding your credentials, employment, or engagements. We share only the information necessary to request and verify the attestation.

IV. Business Transfers.

A. In the event of a merger, acquisition, reorganization, sale of assets, bankruptcy, or other business transaction, your personal information may be transferred to a successor or acquiring entity. To the extent required by applicable law, we will provide notice before your information becomes subject to a materially different privacy policy and will explain any rights available to you regarding your account or authorization.

V. Legal Obligations and Protection of Rights.

A. We may disclose your personal information to law enforcement, governmental authorities, regulators, courts, or other third parties when we believe in good faith that disclosure is necessary to:

1. Comply with applicable laws, regulations, legal processes, or governmental requests, including responding to subpoenas, court orders, or lawful requests for information.

2. Enforce our Terms, this Policy, or other agreements and protect our rights, property, and safety.

3. Detect, prevent, or investigate fraud, security incidents, abuse, violations of our policies, or other harmful or illegal activity.

4. Protect the rights, property, safety, and security of our Users or the public.

VI. Aggregated and De-Identified Information.

A. We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, marketing, or other lawful purposes. Such information is not considered personal information and is not subject to the restrictions in this Policy.

VII. With Your Consent.

A. We may share your personal information with third parties for purposes not described in this Policy when we have obtained your express consent to do so.

Instructors have significant control over the information we collect, verify, and share on their behalf. This Article describes the rights and choices available to Instructors.

I. Voluntary Opt-In and Authorization.

A. Participation in the Platform's verification process and the sharing of Verified Instructor profiles with Hiring Partners is entirely voluntary. By opting in, you authorize DreamFit Collective to collect, verify, host, and share your Verification Data with Hiring Partners as described in the Terms and this Policy.

B. You may decline to opt in or may withdraw your authorization at any time by following the procedures described in Section V below.

II. Profile Access, Review, and Correction.

A. You may access, review, and update your Verified Instructor profile at any time by logging into your account and navigating to your profile settings.

B. You are responsible for maintaining the accuracy, completeness, and currency of your profile information. You agree to promptly update your profile to reflect any changes to your certifications, employment history, insurance status, or other Verification Data.

C. If you believe that any information displayed on your profile is inaccurate, incomplete, or outdated, including any issuer or venue attestation, you may request correction or removal by contacting us at legal@joindreamfit.com. We will address such requests promptly and, where an attestation is disputed, will annotate, correct, or remove the item pending resolution with the issuer or venue that made it.

III. Control Over Attestations.

A. You control whether issuer or venue attestations appear on your profile. All attestations are labeled as the issuer's or venue's statements, and DreamFit Collective does not adopt, endorse, or warrant the accuracy of such attestations.

B. You may request the removal of any attestation from your profile at any time by contacting us at legal@joindreamfit.com. We will remove the attestation or work with the issuer or venue to resolve any dispute regarding its accuracy.

IV. Consent to Third-Party API Data.

A. Connecting Instagram through Meta requires your separate authorization through Instagram. Joining the Platform does not by itself authorize that connection. Independently sourced public information obtained through licensed data providers is described in Article 1, Section III.B and remains subject to the purposes, controls and deletion provisions in this Policy, our API licenses and applicable platform policies.

B. You can turn public social statistics on or off in your Instagram privacy settings within the Platform. Turning this control off hides those statistics from your public Passport, including the corresponding Modash statistics, but does not disconnect Instagram or prevent authorized DreamFit personnel from accessing information needed to provide, verify, support and secure the service. The Instagram handle has a separate public visibility control. You may also request exclusion of specific API Data elements by emailing legal@joindreamfit.com. We will honor such requests to the extent permitted by our API licenses and technical capabilities.

V. Withdrawal of Authorization and Profile Removal.

A. You may withdraw your authorization and request removal of your Verified Instructor profile from the Platform at any time by contacting us at legal@joindreamfit.com.

B. Upon receipt of your withdrawal request, we will:

1. Cease sharing your profile with Hiring Partners, subject to any legal obligations to retain records or honor pre-existing contractual commitments.

2. Mark your profile as inactive and remove it from search results and messaging functionality accessible to Hiring Partners.

3. Handle the deletion or retention of your data in accordance with Section VI below and applicable law.

C. Any confidentiality obligations of Hiring Partners with respect to your profile content shall survive your withdrawal. Hiring Partners who accessed your profile prior to withdrawal may retain records of your profile content in accordance with their own legal obligations and the terms of their agreements with DreamFit Collective.

VI. Data Deletion and Retention.

A. Upon withdrawal of your authorization or termination of your account, we will delete or de-identify your personal information in accordance with our data retention policies and applicable law, except to the extent we are required or permitted to retain certain information for legitimate business purposes, legal compliance, dispute resolution, or enforcement of our agreements.

B. We may retain the following categories of information after withdrawal or termination:

1. Information necessary to comply with legal obligations, including tax, employment, and record keeping requirements.

2. Information necessary to resolve disputes, enforce our Terms or other agreements, or protect our rights and the rights of others.

3. Aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you.

4. Information that has been shared with Hiring Partners prior to withdrawal, subject to their own retention obligations and confidentiality commitments.

We take the security of your personal information seriously and implement commercially reasonable administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, disclosure, alteration, and destruction.

I. Security Measures.

A. Encryption. We use industry standard encryption protocols to protect data in transit between your device and our servers and, where appropriate, to protect data at rest.

B. Access Controls. We restrict access to personal information to employees, contractors, and service providers who need to know that information in order to perform their job functions and who are subject to confidentiality obligations.

C. Authentication and Account Security. We require Users to create strong passwords and implement multi-factor authentication to protect account access.

D. Regular Security Assessments. We conduct periodic security assessments, vulnerability testing, and audits to identify and address potential security risks.

E. Incident Response. We maintain an incident response plan to detect, respond to, and mitigate security incidents and data breaches.

II. Limitations and User Responsibilities.

A. No Guarantee of Absolute Security. Despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission or storage can be guaranteed to be one hundred percent secure. We cannot guarantee the absolute security of your information, and you acknowledge and accept the inherent risks of transmitting information over the internet and storing information electronically.

B. User Account Security. You are responsible for maintaining the confidentiality of your account credentials (username and password) and for all activities that occur under your account. You agree to notify us immediately at legal@joindreamfit.com if you suspect any unauthorized access to or use of your account.

C. Unauthorized Disclosure. If you disclose your password or account credentials to third parties, share your account with others, or fail to secure your device, your personal information may be accessed or disclosed without authorization. We are not responsible for unauthorized access resulting from your failure to safeguard your credentials.

III. Data Breach Notification.

A. In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, we will notify you and any applicable regulatory authorities in accordance with applicable law.

B. We will provide you with information about the nature of the breach, the types of information affected, the steps we are taking to address the breach, and recommendations for steps you can take to protect yourself, to the extent such information is available and disclosure is permitted by law and law enforcement.

We retain your personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

I. Retention Periods.

A. Active Profiles and Accounts. Instructor profiles remain active while published, regardless of login frequency. Accounts remain active while the associated profile is published or the account is otherwise in use for the Platform’s purposes.

B. Inactivity; Deactivation. Accounts with no login and no profile activity for twentyfour (24) months may be deactivated after thirty (30) days’ advance email notice to the address on file.

C. Deletion Timelines. Deletion occurs only upon withdrawal of authorization, termination of the account, or verified deletion request. We will delete or deidentify personal information within ninety (90) days of such event, subject to the exceptions in Section II.

II. Exceptions to Deletion.

A. We may retain certain categories of personal information for longer periods when necessary for:

1. Legal Compliance. Compliance with applicable laws, regulations, tax and accounting requirements, record-keeping obligations, or legal holds and preservation orders.

2. Dispute Resolution and Enforcement. Resolution of disputes, enforcement of our Terms or other agreements, protection of our rights, or defense of legal claims.

3. Legitimate Business Purposes. Fraud prevention, security incident investigation, audit and compliance purposes, and other legitimate business interests.

4. Aggregated and De-Identified Data. We may retain aggregated, anonymized, or de-identified information indefinitely for analytics, research, and other lawful purposes.

B. Information shared with Hiring Partners prior to your withdrawal or account termination may be retained by Hiring Partners in accordance with their own legal obligations and data retention policies and the terms of their agreements with DreamFit Collective.

III. Secure Disposal.

A. When we delete personal information, we do so in a manner designed to prevent unauthorized access, use, or reconstruction of the deleted information, in accordance with industry best practices and applicable legal requirements.

We and our third-party service providers use cookies, web beacons, pixels, and similar tracking technologies to collect information about your use of the Platform and to enhance your user experience.

I. Types of Technologies We Use.

A. Cookies. Cookies are small text files placed on your device by a website or application. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted or expired).

B. Web Beacons and Pixels. Web beacons (also known as pixel tags or clear GIFs) are small graphic images embedded in web pages or emails that allow us to track page views, email opens, and user interactions.

C. Analytics Technologies. We use third‑party analytics services that employ cookies and similar technologies to collect information about your use of the Platform to help us improve functionality and user experience.

II. Purposes for Which We Use Cookies and Tracking Technologies.

A. Essential Cookies. These cookies are necessary for the Platform to function properly and to provide you with access to secure areas and features. Essential cookies include authentication cookies, session management cookies, and security cookies.

B. Performance and Analytics Cookies. These cookies collect information about how you use the Platform, including which pages you visit, how long you stay on each page, and any error messages you encounter. We use this information to improve the Platform's performance, functionality, and user experience. We may use third-party analytics providers, including Google Analytics, to assist us (see Section IV of this Article).

C. Functional Cookies. These cookies allow the Platform to remember choices you make (such as your language preferences or login credentials) and to provide enhanced, personalized features.

III. Your Choices Regarding Cookies.

A. Browser Controls. Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies or to alert you when a cookie is being placed on your device. Please refer to your browser's help menu for instructions on managing cookies.

B. Opt-Out Mechanisms. You may opt out of certain analytics cookies by using tools provided by analytics vendors, such as:

1. Google Analytics: https://tools.google.com/dlpage/gaoptout

C. Consequences of Disabling Cookies. If you disable or decline cookies, certain features and functionality of the Platform may not work properly, and you may not be able to access all areas or features of the Platform.

IV. Google Analytics. We use Google Analytics, a service provided by Google LLC, to understand how the Platform is used and to improve it. Google Analytics uses cookies and similar technologies to collect information such as the pages you visit, the actions you take on the Platform, your device and browser type, and your approximate location derived from your IP address. We use Google Analytics for measurement purposes only: advertising features, ads personalization, and Google Signals are disabled, and we do not use analytics data for advertising or cross-context behavioral advertising. Google processes this information to provide analytics services on our behalf, subject to Google’s data processing terms. To learn more about how Google uses information from sites and apps that use its services, visit https://policies.google.com/technologies/partner-sites. Analytics data is retained for fourteen (14) months. You may opt out of Google Analytics by installing Google’s opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) or through the browser controls described in this Article.

V. Do Not Track and Global Privacy Control.

A. We do not use third‑party advertising or cross‑context behavioral tracking cookies. We also do not “sell” or “share” personal information for cross‑context behavioral advertising as those terms are defined under applicable law. If your browser sends a Global Privacy Control (GPC) signal, we will treat it as a request to opt out of “sale” and “sharing.” Because we do not sell or share personal information for cross‑context behavioral advertising, this setting will have no practical effect on our current practices.

Depending on your location and the nature of your interactions with the Platform, you may have certain rights regarding your personal information. This Article describes those rights and how you may exercise them.

I. General Rights.

A. Access. You have the right to request access to the personal information we hold about you and to receive a copy of that information.

B. Correction. You have the right to request that we correct inaccurate or incomplete personal information we hold about you.

C. Deletion. You have the right to request that we delete your personal information, subject to certain exceptions for legal compliance, dispute resolution, and other legitimate purposes as described in Article 6.

D. Portability. You have the right to request that we provide you with a copy of your personal information in a structured, commonly used, and machine-readable format, and to transmit that information to another service provider where technically feasible.

E. Objection and Restriction. You have the right to object to or request that we restrict certain processing of your personal information, including processing for direct marketing purposes.

II. Communication Preferences and Opt-Out.

A. Marketing Communications. You may opt out of receiving marketing and promotional emails from us by clicking the "unsubscribe" link in any marketing email or by contacting us at legal@joindreamfit.com. Please note that even if you opt out of marketing communications, we will continue to send you transactional and service-related messages regarding your account and use of the Platform.

B. SMS and Text Messages. If and when an SMS program is enabled, participation is optional and requires your express optin consent at enrollment. By opting in, you agree to receive SMS or text messages at the mobile number you provide for transactional or servicerelated purposes. Message frequency varies. Message and data rates may apply. You may reply STOP to cancel and HELP for help. You are not required to opt in as a condition of using the Platform. If the SMS program is not enabled or you do not opt in, we will communicate with you via email.

C. Push Notifications. If applicable, you may disable push notifications from the Platform by adjusting your device settings.

III. State-Specific Privacy Rights.

A. California Residents. If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including:

1. The right to know what personal information we collect, use, disclose, and sell (if applicable).

2. The right to request deletion of your personal information, subject to certain exceptions.

3. The right to opt out of the “sale” or “sharing” of your personal information for cross‑context behavioral advertising purposes. DreamFit Collective does not sell or share personal information for cross‑context behavioral advertising. If we materially change this practice in the future, we will provide the required notices and choices.

4. The right to correct inaccurate personal information.

5. The right to limit the use and disclosure of sensitive personal information, if applicable. DreamFit Collective does not intentionally collect sensitive personal information.

6. The right not to be discriminated against for exercising your CCPA/CPRA rights.

To exercise these rights, please contact us at legal@joindreamfit.com or through your account settings. You may also designate an authorized agent to make requests on your behalf by providing written authorization and proof of identity.

B. Other U.S. State Residents. Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a copy of their personal information, as well as the right to opt out of certain processing activities. To exercise these rights, please contact us at legal@joindreamfit.com.

IV. Exercising Your Rights.

A. To exercise any of the rights described in this Article, please contact us using the contact information provided in Article 13 below. We will respond to your request within the time period required by applicable law.

B. We may require you to verify your identity before fulfilling your request in order to protect your personal information from unauthorized access or disclosure. The verification process may include requesting additional information or documentation.

C. In certain circumstances, we may decline or limit your request where permitted by law, such as when the request is manifestly unfounded or excessive, when disclosure would adversely affect the rights of others, or when we are required to retain the information for legal compliance or defense of legal claims. We will notify you of any such denial and the reasons for it.

The Platform is operated from, and intended for use in, the United States. If you access the Platform from outside the United States, your information will be processed in the United States.

The Platform may contain links to third-party websites, applications, services, or content that are not owned or controlled by DreamFit Collective. This Policy does not apply to those third-party sites or services.

I. No Responsibility for Third-Party Practices.

A. We are not responsible for the privacy practices, content, or security of any third-party websites, applications, or services. We do not endorse, review, or monitor third-party sites or services linked from the Platform.

B. When you click on a link to a third-party site or service, you leave the Platform and become subject to the privacy policy and terms of use of that third party. We encourage you to read the privacy policies of any third-party sites or services you visit.

II. Third-Party Service Providers.

A. Certain features of the Platform may be provided by third-party service providers, including payment processors, analytics providers, API data providers, and customer support platforms. These providers may collect information directly from you or from your use of their services in accordance with their own privacy policies.

B. For information about how third-party service providers collect and use your information, please refer to their respective privacy policies.

III. Social Media and Sharing Features.

A.The Platform may include social media features and widgets (such as Facebook "Like" buttons, Twitter "Tweet" buttons, or LinkedIn "Share" buttons) that enable you to share content or interact with social media platforms. These features may collect information about your use of the Platform and may set cookies to enable the feature to function properly.

B. Your interactions with social media features are governed by the privacy policies of the companies that provide them. We encourage you to review the privacy policies of any social media platforms you use in connection with the Platform.

Instructors may choose to connect their Instagram account to the Platform through Meta Platforms’ official application programming interfaces (each, a “Connected Account”). This Article describes how we collect, use, protect, and delete information in connection with Connected Accounts. It governs information we receive directly from Meta Platforms with your authorization; audience data obtained through licensed third-party data providers is described in Article 1, Section III.B.

I. Information We Receive. When you connect an eligible Instagram professional account through Meta’s official APIs, we receive your Instagram account ID, username and account type, connection and ownership-verification information, related timestamps, and an access token (together, “Connected Account Data”). With the Insights permission, this also includes current follower counts, available account reach, views and interactions for the preceding 30 days, and supported statistics for up to 12 recent eligible media items. Media statistics may include lifetime organic reach, views, interactions, likes and comments. Availability depends on Meta, your account and the content concerned. We never receive or store your Instagram password through this connection.

II. How We Use Connected Account Data. We use Connected Account Data to verify that you control the Instagram account you have claimed, maintain the connection you authorize, and provide account and media statistics in your Passport tools. We use available Meta statistics first and may use corresponding Modash statistics where a Meta value is unavailable. We identify the source and available measurement period; follower counts are not represented as reach. The two providers may use different measurement methods. You control public display through the social-statistics setting described in Article 4, Section IV. We do not sell Connected Account Data, and we do not use it to make or support employment eligibility determinations.

III. Access Token Security and Statistics Retention. Access tokens are encrypted at rest using managed key infrastructure. Decryption is restricted to authorized systems, and tokens are not exposed on public Passports. An ongoing connection allows authorized background and owner-requested refreshes. Stored Meta statistics older than 48 hours stop contributing to displayed statistics. This is a freshness limit, not a promise that all stored copies are physically deleted within 48 hours. New snapshots replace earlier statistics; connection changes and the cleanup process described below remove the applicable snapshots. Meta may also delay reporting activity, so displayed statistics need not include the most recent activity.

IV. Who Can Access the Information. You can view your connection and available statistics through your account. A limited number of authorized DreamFit personnel can access identity, verification and statistics information through protected administrative tools to provide, verify, support and secure the service. When you enable public social statistics on a published Passport, Hiring Partners and other visitors may see the selected figures. Turning public display off does not remove authorized administrative access. Access tokens, private authorization records and deletion-recovery records are not displayed publicly. Amazon Web Services provides storage, encryption and computing services on our behalf, subject to Article 3, Section II. Where Modash is used, the username lookup and separate provider data are handled as described in Article 1, Section III.B.

V. Disconnection, Deauthorization and Deletion. You can disconnect Instagram in your Platform account settings or remove DreamFit Collective through Instagram’s or Facebook’s app settings. On disconnection, deauthorization or an applicable deletion request, we invalidate the authorization used by the Platform and promptly begin removing the access token, Meta statistics, provider identity, Instagram ownership-verification evidence and applicable Meta-derived copies. We complete deletion as soon as reasonably possible within the applicable deadlines described in Article 6. If removal cannot be completed or verified, cleanup remains pending and may require further recovery or assistance. We retain only the identifiers and recovery information needed to finish that work while it remains pending; we do not treat an unresolved cleanup as completed. Pending cleanup does not extend those deletion deadlines.

Disconnecting Instagram does not by itself delete independently entered Passport content, independently sourced public or Modash records, or a human Passport approval that does not depend on Instagram authorization. Those records remain subject to their own purposes, controls and deletion provisions in this Policy. Instagram-only ownership verification may be withdrawn. Our independent verification decision records retain the fact, date and outcome of a decision, rather than erased Meta payloads.

VI. Data Deletion Requests. When Meta sends a data-deletion request on your behalf, we provide a confirmation code and a status page. The public status response contains only status and, when complete, the completion time. A request remains pending while required removal is incomplete or cannot be verified. On completion, we remove the private provider identifiers from the receipt and schedule the completed receipt to expire after 90 days. That receipt lifetime is not an extension of the time allowed to delete Connected Account Data. You may also request deletion of Connected Account Data at any time, with or without an account, by emailing legal@joindreamfit.com.

We reserve the right to modify or update this Policy at any time to reflect changes in our practices, legal requirements, or business operations. When we make changes, we will update the "Last Updated" date at the top of this Policy and, if the changes are material, we will provide notice through the Platform or by other reasonable means.

I. Notice of Material Changes.

A. If we make material changes to this Policy that significantly affect how we collect, use, or disclose your personal information, we will notify you by:

1. Posting a prominent notice on the Platform.

2. Sending an email to the address associated with your account, if you have provided an email address.

3. Other reasonable means as appropriate under the circumstances.

B. Material changes will become effective thirty (30) days after notice is provided, or such other period as we specify in the notice.

II. Non-Material Changes.

A. Non-material changes to this Policy, such as clarifications, corrections of typographical errors, or updates to contact information, will become effective immediately upon posting to the Platform.

III. Continued Use Constitutes Acceptance.

A. Your continued access to or use of the Platform after the effective date of any changes to this Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must cease using the Platform and, if applicable, withdraw your authorization and request deletion of your account as described in Article 4, Section V.

IV. Review Obligation.

A. It is your responsibility to review this Policy periodically for updates. We encourage you to check the "Last Updated" date each time you access the Platform to determine whether any changes have been made.

If you have any questions, comments, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise any of your privacy rights, please contact us using the information below:

DreamFit Collective LLC

Email: legal@joindreamfit.com

We will respond to your inquiry or request within the time period required by applicable law.

I. Severability.

A. If any provision of this Policy is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect, and the invalid, illegal, or unenforceable provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving its intent.

II. Waiver.

A. No waiver of any provision of this Policy shall be deemed a further or continuing waiver of such provision or any other provision, and our failure to assert any right or provision under this Policy shall not constitute a waiver of such right or provision.

III. Entire Agreement.

A. This Policy, together with our Terms and Conditions and any separate written agreements between you and DreamFit Collective, constitutes the entire agreement between you and DreamFit Collective regarding the subject matter hereof and supersedes all prior or contemporaneous understandings, agreements, representations, and warranties, whether written or oral, with respect to such subject matter.

IV. Governing Law.

A. This Policy and any dispute arising out of or related to this Policy or our data practices shall be governed by and construed in accordance with the laws of the State of Florida. For the avoidance of doubt, this Policy and any dispute arising out of or related to this Policy or our data practices are governed by the laws of the State of Florida, without regard to conflicts of law principles, and shall be resolved in accordance with the dispute resolution and arbitration provisions set forth in the Terms. In the event of any inconsistency between this Policy and the Terms regarding governing law, venue, or dispute resolution, the Terms shall control.

V. Dispute Resolution.

A. Any dispute arising out of or related to this Policy or our data practices shall be subject to the dispute resolution and arbitration provisions set forth in Article 20 of the Terms (including the informal resolution process, binding arbitration, class action waiver, massarbitration procedures, and optout provisions). In the event of any inconsistency, Article 20 of the Terms controls.

VI. Language.

A. This Policy is drafted in the English language. If this Policy is translated into any other language, the English version shall control in the event of any conflict or inconsistency.