Privacy Policy

2. Information We Collect

EVA collects personal information through multiple channels in connection with operating the Platform and providing talent booking services.

2.1 Information You Provide Directly

Account Registration Information: When you create a User Account, we collect your full legal name, business email address, company or organization name, job title, phone number, billing address, and account credentials.

Booking and Event Information: When you submit a booking request or confirm a booking, we collect Event details, including event date, venue, location, audience size, budget parameters, and entertainment preferences, as well as contract execution data and correspondence related to your booking.

Payment and Billing Information: We collect billing address, corporate payment method details, and transaction history. Full payment card numbers are processed exclusively by our PCI-DSS-compliant payment processor and are not stored on EVA's own systems.

Communications: We collect the content of emails, messages, inquiries, and other communications you send to EVA or submit through the Platform, including live chat interactions and support requests.

Identity Verification and Compliance Data: For Talent and enterprise clients, we may collect government-issued identification, tax identification numbers (for 1099 administration), W-9 forms, and related compliance documentation.

Feedback and Submissions: Responses to surveys, reviews, ratings, and other feedback you voluntarily provide.

2.2 Information Collected Automatically

When you visit the Platform, we automatically collect certain technical and usage information, including:

• Device and Browser Information: IP address, browser type and version, operating system, device identifiers, and time zone settings.
• Usage Data: Pages and talent profiles viewed, search queries entered on the Platform, features accessed, referring URLs, exit pages, session duration, and click-stream data.
• Transaction Metadata: Booking request history, proposal interactions, contract execution timestamps, and payment event logs.

We collect this information using the following technologies:

• Cookies: Small data files placed on your device that may include anonymous unique identifiers. See Section 8 (Cookie Policy) for details.
• Log Files: Server-side logs recording IP addresses, browser types, ISP information, referring and exit pages, and date/time stamps.
• Web Beacons, Tags, and Pixels: Electronic tracking files used to record browsing behavior and marketing campaign performance.
• Analytics SDKs: Software development kits embedded in our Platform to aggregate usage analytics.

2.3 Information Received from Third Parties

We may receive personal information about you from:

• Business partners and referral sources who introduce Clients or Talent to the Platform, subject to their own authorization to share such data;
• Third-party verification services used to vet Talent or validate Client credentials;
• CRM and marketing platforms (including HubSpot) through which you may have previously engaged with EVA;
• Public professional databases and social media platforms in connection with talent discovery and vetting;
• Credit and payment processing agencies in connection with billing and fraud prevention.

Where EVA receives personal information about you from a third party, EVA relies on that third party's representation that it has a lawful basis to share such information.

2.4 U.S. SMS Text Notifications (Voluntary)

If you choose to receive SMS alerts, you must verify a U.S. mobile phone number in your account notification settings. You then enable SMS separately for each transactional notification category you want (such as booking activity, contracts, payments, event-day check-ins, scheduling, reviews, and unread messages). We do not send SMS for advertising, prospecting, or general marketing; messages are limited to account alerts related to your own use of the Platform.

SMS delivery and opt-out handling are performed by our telecommunications vendor (see Section 5). We may process your mobile number, your category-level SMS preferences, SMS delivery and engagement metadata (for example delivery status or error codes), and the content of compliance-related replies (such as opt-out keywords).

3. How We Use Your Personal Information

EVA uses personal information for the following purposes:

3.1 Platform Operations and Service Delivery

• Creating and managing your User Account;
• Processing booking requests, generating proposals, and facilitating contract execution;
• Coordinating talent logistics, riders, and event-day requirements;
• Processing payments, administering escrow, and issuing invoices;
• Facilitating certificates of insurance (COI) for qualifying bookings;
• Administering 1099 and independent contractor tax reporting for Talent;
• Providing customer support and account management.

3.2 Platform Improvement and Development

• Analyzing usage patterns to improve Platform features, user experience, and talent recommendations;
• Conducting internal research, quality assurance, and product development;
• Generating aggregated, anonymized analytics and performance reports.

3.3 Communication and Marketing

• Responding to inquiries, support requests, and booking-related correspondence;
• Sending transactional communications including booking confirmations, payment receipts, and contract notifications;
• Delivering marketing communications, newsletters, and platform updates to users who have opted in or where permitted by applicable law;
• Administering referral programs, surveys, and promotional campaigns.
• Sending transactional SMS to a verified U.S. mobile number only when you have turned on SMS for the relevant category—such as booking offers and responses, contract-ready and signing reminders, payment reminders, day-of-event check-ins, availability confirmations, schedule changes, talent review windows, and unread message alerts—not promotional texts.

3.4 Legal, Compliance, and Security

• Detecting, investigating, and preventing fraud, circumvention, unauthorized access, and other prohibited activities;
• Complying with applicable laws, regulations, tax obligations, and legal process;
• Enforcing EVA's Terms of Service, including anti-circumvention provisions;
• Protecting EVA's legal rights and the rights of Clients and Talent;
• Screening for sanctions, export controls, and other regulatory compliance obligations.

3.5 Business Operations

• Supporting EVA's internal financial, governance, and operational functions;
• Evaluating potential business transactions including mergers, acquisitions, or financing (subject to Section 8.4);
• Maintaining and protecting EVA's intellectual property and proprietary talent roster.

3.6 Transactional SMS Format and Opt-Out

Outbound SMS messages are prefixed with EVA: and include wording that you can Reply STOP to opt out. If you reply with STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT, we treat that as a request to remove your number from all SMS notification preferences for the Platform (in addition to honoring carrier and vendor requirements). Message and data rates may apply; message frequency varies based on your Platform activity and the categories you enable.

4. Legal Bases for Processing (GDPR)

For users in the European Economic Area ("EEA") or United Kingdom, EVA processes personal data under the following legal bases as defined by the GDPR and UK GDPR:

Where EVA relies on legitimate interests, those interests are balanced against your rights and do not override your fundamental privacy interests. You may request more information about this balancing assessment by contacting [email protected].

5. Sharing Your Personal Information

EVA does not sell, rent, or trade your personal information to third parties for their own marketing purposes. EVA may share personal information in the following circumstances:

5.1 Service Providers and Sub-Processors

EVA engages vetted third-party service providers who process personal data on EVA's behalf under binding data processing agreements. These include:

• HubSpot — CRM, sales, and marketing automation. Privacy policy: https://legal.hubspot.com/privacy-policy
• Intercom — Customer support and live chat. Privacy policy: https://www.intercom.com/legal/privacy
• Google Analytics — Website and Platform analytics. Privacy policy: https://policies.google.com/privacy. Opt-out: https://tools.google.com/dlpage/gaoptout
• Twilio — SMS delivery and related telecommunications compliance (A2P messaging). Privacy policy: https://www.twilio.com/en-us/legal/privacy
• Payment Processors — PCI-DSS-compliant payment processing and fraud detection
• Cloud Infrastructure Providers — Secure hosting, data storage, and backup
• E-Signature Providers — Contract execution and document management
• Tax and Accounting Platforms — 1099 administration and financial reporting

A current list of sub-processors is available upon written request to [email protected].

5.2 Booking Counterparties

In connection with a confirmed booking, EVA shares relevant Client and Event information with the applicable talent (and vice versa) to the extent necessary to fulfill the engagement. Both parties are expected to handle shared information with professional confidentiality.

5.3 Legal and Regulatory Disclosure

EVA may disclose personal information when required to do so by law, court order, subpoena, regulatory inquiry, or other legal process, or when EVA reasonably believes disclosure is necessary to protect EVA's legal rights, prevent fraud or criminal activity, or protect the safety of any person.

5.4 Business Transfers

In the event of a merger, acquisition, financing, reorganization, or sale of all or substantially all of EVA's assets, personal information held by EVA may be transferred to the successor entity, subject to equivalent privacy protections. EVA will provide notice of any such transfer via the Platform or email prior to your personal information becoming subject to a materially different privacy policy.

5.5 With Your Consent

EVA may share personal information with third parties not described above when you have provided explicit consent to such sharing.

6. Targeted Advertising

EVA may use personal information to deliver targeted advertising and marketing communications that we believe may be relevant to your professional interests and event procurement activities. This includes retargeting campaigns, display advertising, and sponsored content on third-party platforms. Transactional SMS notifications (U.S., category opt-in) are described in Sections 2.4 and 3.6; EVA does not use SMS for promotional or marketing campaigns under this section.

You may opt out of targeted advertising through the following platform-specific controls:

• Facebook/Meta: https://www.facebook.com/help/568137493302217
• Google: https://www.google.com/settings/ads/anonymous
• Microsoft/Bing: https://about.ads.microsoft.com/en-us/resources/policies/personalized-ads
• LinkedIn Sponsored Content: https://www.linkedin.com/help/linkedin/answer/62649
• Apollo.io: https://www.apollo.io/privacy-policy

You may also opt out of interest-based advertising more broadly through the Digital Advertising Alliance's opt-out portal at http://optout.aboutads.info or the Network Advertising Initiative at http://www.networkadvertising.org.

Please note that opting out of targeted advertising does not opt you out of all advertising — you may continue to receive non-targeted or contextual advertisements.

7. Artificial Intelligence and Automated Processing

7.1 EVA's Use of Artificial Intelligence

EVA uses artificial intelligence ("AI") and machine learning technologies to enhance Platform functionality, improve talent matching, and deliver more relevant marketing communications. This section describes how AI is used, what data informs those systems, and your rights with respect to automated processing.

EVA's current AI-assisted functions include:

• Talent Recommendations: AI-assisted matching and ranking of Talent based on your event parameters, booking history, budget, industry, and stated preferences;
• Search and Discovery: Machine learning models that personalize Platform search results and surface relevant talent profiles;
• Marketing Personalization: AI-driven segmentation, content personalization, email timing optimization, and audience targeting based on Platform behavior and booking data;
• Fraud and Circumvention Detection: Automated pattern recognition to identify account activity consistent with prohibited off-platform bookings or other Terms of Service violations;
• Demand and Pricing Signals: Aggregated, anonymized analysis of booking trends to inform talent availability and market pricing intelligence.

7.2 Automated Decision-Making

Some EVA Platform functions involve automated processing that may influence your experience, including talent recommendations and marketing content you receive. EVA does not currently make fully automated decisions that produce legal or similarly significant effects on users — such as denying access to the Platform or terminating a contract — without human review.

Where automated processes flag an account for potential Terms of Service violations (including circumvention), a qualified EVA team member reviews the flagged activity before any enforcement action is taken.

Right to Human Review. If you believe an automated process has produced an outcome that materially affects your access to EVA's services or your booking experience, you may request human review by contacting [email protected]. EVA will acknowledge your request within five (5) business days and provide a response within thirty (30) days.

7.3 AI-Driven Marketing and Profiling

EVA uses AI-powered tools, including features within HubSpot, Google, LinkedIn, and Apollo.io, to build audience profiles and deliver targeted marketing communications. The data inputs that may inform these profiles include:

• Account registration data (company type, industry, role);
• Booking history, event types, and budget ranges;
• Platform browsing behavior and feature engagement;
• Email interaction data (open rates, click-through behavior);
• Geographic and firmographic data.

This profiling is used solely to deliver more relevant outreach to event procurement professionals and is not used to make decisions that adversely affect your legal rights or access to services.

Right to Opt Out of AI Profiling for Marketing. You have the right to object to AI-driven profiling for marketing purposes at any time. To exercise this right:

• Click "unsubscribe" in any EVA marketing email; or
• Contact [email protected] with the subject line "Opt Out — AI Marketing Profiling."

For EEA and UK residents, this right is guaranteed under GDPR Article 21. For California residents, this right is available under the CPRA. EVA honors opt-out requests from all users regardless of location.

7.4 Third-Party AI Tools and Sub-Processor AI Practices

EVA uses third-party platforms that incorporate AI features to deliver Platform services and marketing operations. EVA takes the following position with respect to third-party AI data use:

• EVA does not authorize any third-party sub-processor to use EVA Client or Talent personal data to train, fine-tune, or improve that third party's own AI or machine learning models, except where EVA has separately disclosed and obtained consent for such use;
• EVA reviews the AI data use policies of key sub-processors and requires contractual commitments limiting the use of EVA data to service delivery purposes only;
• Where a sub-processor updates its AI data practices in a manner that affects EVA users, EVA will update this Policy and notify affected users as required.

Clients with enterprise data governance requirements for third-party AI are encouraged to request a Data Processing Agreement ("DPA") and a sub-processor addendum by emailing [email protected].

7.5 EVA's Internal AI Model Development and Training

EVA develops, trains, and continuously improves its proprietary AI and machine learning models to enhance Platform performance, talent-matching accuracy, booking intelligence, fraud detection, and marketing effectiveness. By using the Platform, you acknowledge and agree that EVA may use Platform data as described in this Section to train, fine-tune, validate, and improve EVA's internal AI systems.

Data Used for AI Training. EVA may use the following categories of Platform data for AI model development:

• Booking and event data (event type, size, budget, industry, geography, and entertainment category);
• Talent performance metrics, availability patterns, and engagement data;
• Client search behavior, recommendation interactions, and booking conversion data;
• Communication metadata (not content) and platform usage patterns;
• Aggregated pricing, demand, and availability signals.

Anonymization and Pseudonymization Standards. EVA applies the following tiered approach to data used in AI training:

• Tier 1 — Aggregated and Anonymized Data: Booking trends, demand signals, and platform usage patterns are aggregated and anonymized prior to use in model training such that no individual Client, Talent, or user can be reasonably re-identified. No opt-out is required for Tier 1 data use, as it does not constitute processing of personal data under applicable privacy law.
• Tier 2 — Pseudonymized Data: Where individual-level behavioral data (such as search patterns or recommendation interactions) is used to improve personalization models, EVA pseudonymizes such data by replacing direct identifiers with internal tokens. Pseudonymized data is processed under EVA's legitimate interests in improving Platform services. You have the right to object to this processing as described below.
• Tier 3 — Identifiable Personal Data: EVA will not use directly identifiable personal data (such as your name, email address, or company name) in AI model training without your explicit, separately obtained consent. Where EVA seeks to use Tier 3 data for AI training purposes, EVA will present a clear consent request describing the specific use, and you may decline without affecting your access to the Platform.

Legal Bases for AI Training. EVA processes data for AI model training under the following legal bases:

• Tier 1 data: Not subject to privacy law (anonymized);
• Tier 2 data: Legitimate interests (EVA's interest in improving Platform accuracy and service quality, balanced against user privacy interests);
• Tier 3 data: Consent (separately obtained).

For EEA and UK users, EVA's legitimate interests assessment for Tier 2 processing is available upon request at [email protected].

Your Right to Object. You have the right to object to EVA's use of your pseudonymized Platform data (Tier 2) for AI model training at any time. To exercise this right, contact [email protected] with the subject line "Opt Out — AI Model Training." EVA will honor your request within thirty (30) days. Opting out of AI training data use will not affect your access to the Platform or any confirmed bookings.

Data Quality and Model Governance. EVA commits to the following AI model governance standards:

• AI models are trained only on data collected in accordance with this Privacy Policy and EVA's Terms of Service;
• EVA conducts periodic reviews of AI systems to identify and remediate unintended retention of personal data within model outputs;
• AI models are evaluated for accuracy, bias, and fairness prior to deployment in client-facing features;
• AI training data is subject to the same retention and disposal standards described in Section 9 of this Policy;
• EVA does not share trained AI models or the underlying training datasets with third parties except as required to operate the Platform under binding confidentiality obligations.

No Sale of AI-Derived Insights. EVA does not sell AI-generated profiles, predictive scores, or individually attributed insights derived from Platform data to third parties.

7.6 U.S. State AI Privacy Rights

Several U.S. states have enacted or are enacting laws addressing consumer rights with respect to automated decision-making and AI profiling, including Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Virginia (VCDPA), and others. EVA is committed to honoring applicable AI-related rights for residents of these states, including:

• The right to know when a consequential decision affecting you has been made using automated processing;
• The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects;
• The right to appeal an automated decision and obtain human review.

To exercise any of these rights, contact [email protected] with your state of residence and a description of your request. EVA will respond in accordance with the applicable law of your state.

7.7 AI Transparency Commitment

EVA is committed to responsible AI practices. EVA does not use AI systems that make inferences about protected characteristics (race, religion, national origin, gender, disability, or similar attributes) in connection with Platform services or marketing. EVA periodically reviews its AI-assisted tools for bias, accuracy, and compliance with applicable law. If you have concerns about EVA's AI practices, please contact [email protected].

8. Cookie Policy

8.1 Types of Cookies We Use

8.2 Managing Cookies

You may manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. For guidance, visit http://www.allaboutcookies.org. Please note that disabling certain cookies may impair Platform functionality.

8.3 Do Not Track

EVA's Platform does not currently alter its data collection practices in response to browser-transmitted "Do Not Track" signals, as no universally accepted standard for responding to such signals has been established. We will reassess this position as standards evolve.

9. Data Retention

EVA retains personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements, including the following retention standards:

Upon expiration of the applicable retention period, personal information is securely deleted or anonymized in accordance with EVA's data disposal procedures.

10. Your Privacy Rights

10.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information EVA has collected about you, the sources, the business purposes, and the categories of third parties with whom it has been shared.
• Right to Delete: Request deletion of personal information EVA holds about you, subject to legal exceptions (e.g., information needed to complete a transaction or comply with a legal obligation).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: EVA does not sell personal information. EVA may share certain information with advertising partners for cross-context behavioral advertising; you may opt out as described in Section 6.
• Right to Limit Use of Sensitive Personal Information: To the extent EVA processes sensitive personal information as defined under CPRA, you may request limitation of such use to purposes permitted by law.
• Right to Non-Discrimination: EVA will not discriminate against you for exercising any of these rights.

To exercise your California rights, contact EVA at [email protected] or by mail at the address in Section 14. We will respond to verified requests within forty-five (45) days, with one possible extension of an additional forty-five (45) days where reasonably necessary.

10.2 EEA and UK Residents (GDPR/UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

• Right of Access (Art. 15): Obtain confirmation of whether EVA processes your personal data and request a copy.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of personal data where it is no longer necessary, consent has been withdrawn, or processing is unlawful.
• Right to Restriction (Art. 18): Request that EVA restrict processing of your personal data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format and transmit it to another controller, where technically feasible.
• Right to Object (Art. 21): Object to processing based on legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: Lodge a complaint with your local supervisory authority. In the United States, you may also contact EVA's DPO directly.

To exercise these rights, contact [email protected]. EVA will respond within thirty (30) days, extendable to ninety (90) days for complex requests with prior notice.

International Transfers: EVA is headquartered in Nashville, Tennessee, USA. If you are located in the EEA or UK, your personal data will be transferred to and processed in the United States. EVA relies on Standard Contractual Clauses (SCCs) adopted by the European Commission as the transfer mechanism for such transfers. Copies of applicable SCCs are available upon request.

10.3 All Users

Regardless of location, all Platform users may:

• Update Account Information: Log in to your User Account to review and update your personal information at any time.
• Opt Out of Marketing: Unsubscribe from marketing emails by clicking the "unsubscribe" link in any EVA marketing communication or by contacting [email protected].
• Opt Out of Transactional SMS: Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) to any EVA SMS to remove your number from all SMS notification preferences, or adjust categories in your notification settings.
• Request Account Deletion: Contact [email protected] to request deletion of your account and associated personal information, subject to EVA's legal retention obligations.

11. Data Security

EVA implements and maintains a comprehensive information security program designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of sensitive data at rest;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Multi-factor authentication for Platform administrative access;
• Regular vulnerability assessments and penetration testing;
• Incident response procedures and a data breach notification protocol.

Data Breach Notification. In the event of a confirmed security incident involving your personal information, EVA will notify affected individuals and applicable regulatory authorities in accordance with applicable law and without unreasonable delay, providing information about the nature of the breach, data affected, and remediation steps taken.

No method of electronic transmission or storage is completely secure. While EVA employs industry-standard safeguards, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

12. Children's Privacy

The Platform is intended solely for professional use by individuals 18 years of age or older. EVA does not knowingly collect personal information from individuals under the age of 18. If EVA becomes aware that personal information has been collected from a minor, EVA will promptly delete such information. If you believe EVA has inadvertently collected information from a minor, please contact [email protected].

13. Changes to This Privacy Policy

EVA may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or Platform features. When we make material changes, we will:

• Post the updated Policy on the Platform with a revised "Last Updated" date;
• Notify registered users via email to the address associated with their account; and
• Where required by applicable law, seek renewed consent.

Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. If you disagree with a material change, you may close your account and cease use of the Platform as described in Section 9.3.

14. Contact Information

For questions, requests, or complaints regarding this Privacy Policy or EVA's data practices, please contact us:

EVA Entertainment, Inc. 1030 16th Ave South, Second Floor Nashville, TN 37212

[email protected]

EVA will acknowledge receipt of privacy-related requests within five (5) business days and respond substantively within the timeframes required by applicable law.

© 2026 EVA Entertainment, Inc. All rights reserved. "EVA" and the EVA logo are trademarks of EVA Entertainment, Inc.