Privacy Notice

This Privacy Notice (the "Notice") explains how RUBA GLOBAL LLC, a New Jersey limited liability company with its registered office at 99 Green Grove Ave, Keyport, New Jersey 07735 ("Ruba", "we", "us", or "our"), collects, uses, discloses, retains, and protects Personal Data. This Notice is effective July 25, 2026.

This Notice is not a request for consent and does not limit rights provided by applicable law. Where consent is required, Ruba requests it separately. The provisions that apply to you depend on how you interact with Ruba.

Your contractual relationship with Ruba is governed by the Seller Services Agreement, Buyer Purchase Terms, or another applicable agreement. This Notice describes Ruba's Processing and does not replace those agreements.

Definitions

In this Notice:

"Buyer" means a person who purchases a Product from Ruba through Ruba Checkout.

"Card Network" means a payment card network such as Visa, Mastercard, American Express, or Discover.

"Chargeback" means a payment dispute, reversal, retrieval, or similar process initiated by a Buyer, issuing institution, Card Network, acquirer, or Payment Processor.

"Controller" means a person that determines why and how Personal Data is Processed. Applicable law may use a similar term, including "business."

"Merchant of Record" means Ruba's role as the seller to the Buyer for a Transaction, including charging the Buyer in Ruba's name and administering the associated payment, transaction documentation, applicable Transaction Taxes, refunds, and Chargebacks under the agreements governing the Transaction.

"Payment Processor" means a regulated payment, acquiring, payout, banking, fraud, or related financial-service provider used to support the Services.

"Personal Data" means information linked or reasonably linkable to an identified or identifiable individual or household. It includes information called "personal information" or a similar term under applicable law and excludes information that applicable law excludes.

"Process", "Processed", and "Processing" mean an operation performed on Personal Data, including collection, use, disclosure, storage, or deletion.

"Processor" means a person that Processes Personal Data on behalf of a Controller and subject to the Controller's documented instructions. Applicable law may use a similar term, including "service provider" or "contractor."

"Product" means approved software, software-as-a-service, an API, a digital download, a license key, digital content, a subscription, or another digital offering that Ruba has expressly approved for resale, including approved integration, implementation, or support fees that are secondary to that offering. An individual freelancer may sell an approved Product. A Product does not include physical goods, donations, crowdfunding, or an offering whose principal purchased value is consulting, custom design or development, agency work, coaching, managed technical support, or another manually fulfilled human service, or any prohibited or restricted offering, unless Ruba expressly approves it in writing.

"Ruba Checkout" means the checkout interface made available by Ruba through which Buyers may purchase Products using the payment methods actually displayed at checkout.

"Seller" means a person or entity that has accepted the Seller Services Agreement.

"Services" means Ruba's website, accounts, checkout, buyer access, applications, and reseller, payment, subscription, tax, payout, fulfillment, support, and related services.

"Transaction" means a completed sale of a Product by Ruba to a Buyer through Ruba Checkout.

"Transaction Taxes" means sales tax, use tax, value-added tax, goods and services tax, and similar indirect transaction taxes charged on a Transaction. Transaction Taxes do not include income, business, payroll, property, or other direct taxes.

"Website" means https://getruba.com.

"You" and "your" mean the individual whose Personal Data is addressed by this Notice, including a Website visitor, Seller or Seller representative, Buyer, Product user, or another individual who interacts with Ruba.

1. Scope and Privacy Roles

1.1. This Notice applies when you visit the Website, create or use an account, apply or onboard as a Seller, purchase or use a Product, manage a Transaction, contact Ruba, or otherwise interact with the Services.

1.2. This Notice does not govern a Seller's independent Product, website, support, marketing, or other activity that the Seller controls, or a third-party service Ruba does not control. The applicable Seller or third party is responsible for its own Processing and privacy notice.

1.3. Ruba acts as an independent Controller when Ruba Processes Personal Data to establish accounts; operate as reseller and Merchant of Record; administer Transactions, payments, subscriptions, payouts, taxes, receipts, refunds, and payment disputes; prevent fraud and protect the Services; comply with law; maintain records; provide support; and operate and improve the Services.

1.4. A Seller acts as an independent Controller for Personal Data it Processes to provide and support its Product, operate its business, communicate independently with Buyers, or satisfy its legal obligations. The Seller Services Agreement restricts a Seller's use of Personal Data received through Ruba.

1.5. Ruba acts as a Processor only for a separately identified feature through which Ruba Processes Personal Data solely on a Seller's documented instructions. That Processing is governed by a separately accepted Data Processing Addendum.

2. Personal Data Ruba Processes

The categories depend on your relationship with Ruba. Ruba may have Processed the following categories during the preceding 12 months:

2.1. Ruba does not require every category in every interaction. Information may be optional, required only for an applicable feature, country, payment method, risk review, tax status, or legal requirement, or collected directly by a Payment Processor.

2.2. A Seller may provide customer records or configure approved information fields. Ruba Processes the information submitted through those features. Sellers must not submit sensitive Personal Data unless Ruba has expressly approved it.

3. Sources of Personal Data

Ruba may obtain Personal Data:

3.1. directly from you;

3.2. from a Seller or organization using the Services;

3.3. automatically from your device or use of the Services;

3.4. from Payment Processors, financial institutions, payment networks, and providers supporting verification, fraud prevention, tax, security, communications, support, or other Services; and

3.5. from integrations you choose, public sources, government authorities, or persons reporting suspected fraud, abuse, infringement, or unlawful activity.

4. Purposes of Processing

Ruba Processes Personal Data to:

4.1. create, verify, secure, and administer accounts and Seller onboarding;

4.2. operate as reseller and Merchant of Record and administer Transactions, subscriptions, payments, payouts, transaction taxes, receipts, refunds, payment disputes, and records;

4.3. fulfill Products and provide requested features, support, and communications;

4.4. prevent fraud, enforce Ruba's agreements, protect rights and the Services, comply with law and financial-network requirements, and establish, exercise, or defend legal claims;

4.5. operate, maintain, measure, and improve the Services;

4.6. send promotional communications where permitted by law, subject to any applicable right to unsubscribe or object; and

4.7. obtain professional advice, manage risk and insurance, complete a financing or corporate transaction, and operate Ruba's business.

Ruba will provide any additional notice or obtain any consent required before materially incompatible Processing.

5. EEA and UK Legal Bases

Where European Economic Area or United Kingdom data-protection law applies, Ruba relies, as applicable, on:

• performance of a contract or steps requested before entering a contract;
• compliance with legal obligations;
• Ruba's legitimate interests in providing, protecting, administering, and improving the Services, preventing fraud, and enforcing legal rights, where those interests are not overridden by your rights;
• consent, where Ruba requests it; and
• establishment, exercise, or defense of legal claims.

You may object to Processing based on legitimate interests and may withdraw consent as described in Section 10. Withdrawal does not affect Processing that occurred lawfully before withdrawal.

6. Disclosures of Personal Data

Ruba may disclose the following categories of Personal Data to the following categories of recipients for the stated purposes:

6.1. Sellers: identifiers, contact, Transaction, Product, fulfillment, and support information needed to fulfill and support a Product, administer a Transaction, prevent fraud, or comply with law.

6.2. Payment and financial providers: identifiers, contact, Seller, business, verification, Transaction, financial, tax, risk, and dispute information needed to provide financial services, prevent fraud, or comply with law. If Stripe, Inc. or an applicable affiliate ("Stripe") provides an applicable service, Stripe receives Personal Data provided in connection with that service and Processes it under its Privacy Policy.

6.3. Operational providers: Personal Data needed for technology, communications, support, analytics, tax, security, identity-verification, fraud-prevention, and other operational services.

6.4. Third parties you choose: information needed for an external authentication, integration, fulfillment, or other service you authorize.

6.5. Professional advisers and business counterparties: information needed for legal, tax, accounting, compliance, insurance, financing, diligence, or a corporate transaction, subject to appropriate confidentiality obligations.

6.6. Authorities and affected persons: information Ruba reasonably believes must or may lawfully be disclosed to comply with law or legal process; prevent or investigate fraud, security incidents, or unlawful activity; protect rights, safety, or property; enforce agreements; or establish, exercise, or defend legal claims.

6.7. At your direction or with your consent: information disclosed to a recipient you authorize or for a purpose presented when authorization or consent is requested.

Ruba may use and disclose aggregated or de-identified information that applicable law no longer treats as Personal Data, subject to restrictions required by applicable law.

7. Cookies and Similar Technologies

7.1. Ruba may use cookies and similar technologies to provide, secure, remember preferences for, measure, and improve the Services.

7.2. Ruba provides any notice, choice, or consent required by applicable law. Available Website, browser, or device controls may allow you to manage these technologies. Blocking necessary technologies may prevent parts of the Services from functioning.

8. Sale, Targeted Advertising, and Automated Processing

8.1. As of the effective date of this Notice, Ruba does not sell Personal Data or share or Process Personal Data for targeted or cross-context behavioral advertising as those terms are defined by applicable United States state privacy laws.

8.2. Ruba and financial providers may use automated systems for payment decisions, fraud prevention, risk, security, and compliance. A financial provider may make an independent decision under its own terms and legal obligations.

8.3. Where applicable law provides a right concerning qualifying profiling or solely automated decisions, you may submit a request under Section 10. Applicable exceptions may permit Ruba to continue Processing, including where necessary to perform a contract, prevent fraud, or comply with law.

9. Retention

9.1. Ruba retains Personal Data for as long as reasonably necessary for the purposes described in this Notice or as required or permitted by law. The period depends on the information, relationship, legal and accounting requirements, payment-dispute periods, fraud and security risk, active disputes or investigations, and Ruba's need to exercise or defend legal rights.

9.2. When Personal Data is no longer required, Ruba deletes, anonymizes, or disposes of it, subject to applicable law, legal holds, fraud-prevention needs, and ordinary backup or deletion cycles.

10. Privacy Rights and Requests

10.1. Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of Personal Data; withdraw consent; opt out of qualifying sale, targeted advertising, or profiling; limit certain uses of sensitive Personal Data; use an authorized agent; appeal a refusal; and receive equal service without unlawful discrimination.

10.2. To submit a request, email privacy@getruba.com and identify your relationship with Ruba and the right requested. Ruba may request information necessary to verify identity or authority, locate records, protect another person, or prevent fraud.

10.3. Ruba will respond within the period required by applicable law. Ruba may deny or limit a request where verification fails or an applicable exception permits, including to complete a Transaction, prevent fraud, maintain security, protect another person, comply with law, preserve legal claims, or retain required records.

10.4. Where applicable law provides an appeal right, you may appeal by replying to the denial or emailing privacy@getruba.com with the subject "Privacy Appeal." Ruba will provide any further complaint method required by applicable law.

10.5. This Section applies only to the extent the relevant law applies to Ruba and the Processing. It does not create a right that applicable law does not provide.

11. EEA, UK, and Swiss Information

11.1. Where applicable European Economic Area, United Kingdom, or Swiss data-protection law applies, RUBA GLOBAL LLC is the Controller for the Controller activities described in Section 1.

11.2. Subject to applicable conditions and exceptions, you may exercise the rights described in Section 10 and lodge a complaint with a competent supervisory authority. The European Data Protection Board provides a directory of EEA supervisory authorities, and the United Kingdom Information Commissioner's Office provides information at ico.org.uk.

11.3. Providing certain Personal Data may be necessary to enter into or perform a contract, complete a Transaction, receive a payout, comply with law, or provide a requested Service. Ruba or a Payment Processor may be unable to provide the relevant Service without that information.

12. International Processing

12.1. Ruba is established in the United States. Ruba and recipients described in Section 6 may Process Personal Data in the United States and other countries whose privacy laws may differ from those where you live.

12.2. Where applicable law restricts a transfer, Ruba will use a transfer mechanism permitted by that law. Depending on the circumstances, this may include an adequacy decision, standard contractual clauses, an approved addendum, or another lawful mechanism. Transfers of Processor Data are governed by an applicable Data Processing Addendum.

13. Security

13.1. Ruba uses safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure, or access, taking into account the nature of the information and risk.

13.2. No system is completely secure, and Ruba cannot guarantee absolute security. You are responsible for protecting credentials and access links within your control and should promptly notify support@getruba.com of suspected unauthorized access.

14. Children

14.1. The Website and Services are not directed to children under 13, and Ruba does not knowingly solicit Personal Data directly from a child under 13. If you believe Ruba has collected such information, contact privacy@getruba.com.

14.2. A Seller must obtain Ruba's prior written approval before offering a Product directed to children or using the Services to collect information about children and must comply with the Acceptable Use Policy and applicable law.

15. Changes and Contact

15.1. Ruba may update this Notice to reflect changes in law or Ruba's Processing. Ruba will update the date above and provide any additional notice or request any consent required by applicable law.

15.2. Questions, requests, and appeals may be sent using the contact information below.

Contact

RUBA GLOBAL LLC
99 Green Grove Ave
Keyport, New Jersey 07735
Privacy questions, requests, and appeals: privacy@getruba.com
General and technical support: support@getruba.com