SUPERSAURUS PRIVACY POLICY

Last Updated: September 25, 2026

Welcome to Supersaurus!

Supersaurus, Inc. is headquartered in San Diego, California. We create and operate games and related services, including Punch Upon a Time.

This Supersaurus Privacy Policy (this "Policy") describes the different ways we may collect, use, secure, retain, disclose, and otherwise process information that can be used to identify you on, through, or in connection with the Supersaurus Services (defined below). It also explains how we use cookies and similar technologies, and the choices you have.

Please read this entire Policy carefully, along with any other terms that apply to your use of the Supersaurus Services. If you have any questions, you can reach us using the contact information in Section 12 (How Can You Contact Us?).

Table of Contents

1. What Does This Policy Cover?
2. Children
3. What Information Do We Collect and How?
4. Why Do We Process Information?
5. Who Do We Disclose Information To?
6. How Do We Use Cookies and Similar Technologies?
7. Where Do We Process Information?
8. How Do We Handle and Retain Information?
9. What Choices and Controls Do You Have?
10. Will This Policy Be Updated?
11. Additional Notice for Residents of Certain US States
12. How Can You Contact Us?

1. WHAT DOES THIS POLICY COVER?

When we refer to "Supersaurus" (or any similar terms like "we," "us," or "our") in this Policy, we mean Supersaurus, Inc., the entity that controls and is responsible for your information. You can find our contact details in Section 12 (How Can You Contact Us?).

We use the term "Supersaurus Services" to describe any Supersaurus products or services that directly link to this Policy, including:

• our games (e.g., Punch Upon a Time);
• our websites and their respective subdomains (e.g., playpuat.com and www.supersaurus.com);
• our community spaces that we operate and where this Policy is posted (e.g., our official Discord server);
• our newsletters, playtest programs, wishlist campaigns, and other sign-up and marketing activities; and
• live events and playable demos where this Policy is posted.

Your use of the Supersaurus Services may also be subject to additional terms that we post from time to time, such as contest rules or platform-specific terms.

This Policy does not cover third-party platforms. When you access our games through a third-party platform or storefront (for example, Steam, or a console platform), that platform's own privacy policy governs the information it collects about you. We encourage you to review those policies. See Section 5 (Who Do We Disclose Information To?) for more detail on our relationships with these platforms.

2. CHILDREN

The Supersaurus Services are intended for a general audience and are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13, and we do not ask for or collect personal information from children with a parent's or guardian's permission. If you are under 13, please do not sign up for our newsletter, provide your email address or phone number, or otherwise submit personal information to us. If you would like to hear when Punch Upon a Time is released, please ask a parent or guardian to sign up instead.

If you believe we have collected a child's information. If you are a parent or guardian and you believe that your child under 13 has provided us with personal information, please contact us using the information in Section 12. We will delete that information promptly, including from any partially completed sign-up, and we will not use it for any purpose in the meantime.

We do not knowingly use personal information collected from children for advertising, and we do not knowingly disclose personal information collected from children to advertising platforms.

3. WHAT INFORMATION DO WE COLLECT AND HOW?

The types of information we collect depend on how you interact with the Supersaurus Services. Generally speaking, we collect information in three ways: (A) when you provide it to us, (B) automatically when you use the Supersaurus Services, and (C) from third parties.

This Policy is designed to help you understand how we handle information that can be used to identify you. In some cases, we may also create or collect information that does not identify you individually, such as de-identified or aggregated information. If we combine this type of information with information that identifies you, we will treat the combined information as information that can be used to identify you subject to this Policy.

A. Information You Provide

You can choose to provide us with different types of information depending on how you use the Supersaurus Services. In some cases, we will ask you for specific information because we need it for the Supersaurus Services or their respective features. If you choose not to provide the requested information, you may be unable to access those Supersaurus Services, or features may not work properly. For example:

• Sign-up and marketing information. When you join our newsletter, request demo or playtest access, sign up for announcements, or complete a form on our website, we collect the information you submit — typically your email address, and where requested, your name, country, gaming platform preference, and responses to optional survey questions.
• Phone number and text-message consent. If you choose to give us your mobile phone number and tick the box agreeing to receive text messages, we collect the number, the fact and time of your consent, and the exact consent wording that was shown to you. Providing a phone number is optional, and agreeing to receive texts is never a condition of signing up or of any purchase. See Section 9 for how to stop.
• Partly completed sign-ups. Our sign-up form saves your answers as you go. If you enter your email address and then leave before finishing, we keep the address you entered, together with the technical identifiers described in Section 3(B). We may email you about the demo or the game using that address, and every such email includes an unsubscribe link. We do not send text messages to a phone number entered in a sign-up that was not completed. You can ask us to delete a partly completed sign-up at any time (Section 12).
• Account information. If and when we offer Supersaurus accounts, we may collect basic registration information (e.g., display name, password, country, and email address) to create and maintain your account, provide the Supersaurus Services you requested, enforce the terms that govern your use of the Supersaurus Services, and maintain appropriate records.
• Gameplay and in-game content. When you play our games, we may collect information about your gameplay, including match results, progression, settings, and in-game preferences.
• Communications and user-generated content. When you contact our support team, post in our official community spaces, participate in chat or voice features, or submit feedback, bug reports, clips, or other content, we collect the content of those communications and submissions along with any information you choose to include.
• Applications. If you apply for a role with us, we collect the information in your application and any materials you submit.

B. Information Collected Automatically

When you use the Supersaurus Services, we and our service providers may automatically collect:

• Device and technical information, such as device type, operating system and version, browser type, language settings, screen resolution, and hardware identifiers.
• Network information, such as IP address and approximate location derived from it (typically country or region level), and internet service provider.
• Usage information, such as pages viewed, features used, session length and timestamps, referral source, the page you arrived on, actions taken within our games and websites (including how far you progressed through a sign-up form), and crash and performance diagnostics.
• Advertising and measurement identifiers, including click identifiers passed to us by advertising platforms when you arrive from an advertisement (for example, Meta's fbclid, Google's gclid, gbraid, and wbraid, and Reddit's rdt_cid), campaign parameters in the web address (such as utm_source), cookie identifiers set by advertising technologies, and mobile advertising identifiers where applicable.

Section 6 (How Do We Use Cookies and Similar Technologies?) describes the technologies we use to collect this information and the controls available to you.

C. Information From Third Parties

We may receive information about you from third parties, including:

• Gaming platforms and storefronts (for example, Steam) — such as your platform account identifier, display name, country, and information about your entitlements or wishlist activity, in accordance with that platform's policies and your settings there.
• Social media and community platforms (for example, Discord, YouTube, X, TikTok, and Instagram) — where you interact with our official accounts or link an account, in accordance with that platform's policies and your settings.
• Advertising and analytics partners — such as aggregated campaign performance and measurement information, and information used to match conversions to advertisements.
• Service providers that help us with fraud prevention, security, and content moderation.

4. WHY DO WE PROCESS INFORMATION?

We process information for the following purposes:

• To provide the Supersaurus Services — to operate, maintain, and deliver our games, websites, and community spaces, including matchmaking, saving progress, and enabling features you request.
• To communicate with you — to send you the announcements, newsletters, demo keys, and playtest invitations you signed up for, to send text messages if you agreed to receive them, to respond to your support requests, and to send service messages about changes to our products or terms.
• To improve and develop our products — to understand how our games and websites are used, diagnose technical problems, conduct analytics and research, and develop new features and titles.
• To market our products — to promote the Supersaurus Services, measure the effectiveness of our advertising, and help advertising platforms show our advertising to people who are likely to be interested in it. See Sections 6 and 9 for the controls available to you.
• To keep our services safe and fair — to authenticate users, detect and prevent cheating, fraud, abuse, and security incidents, and enforce our terms and community standards.
• To comply with legal obligations — to meet our obligations under applicable law, respond to lawful requests, and establish, exercise, or defend legal claims.

5. WHO DO WE DISCLOSE INFORMATION TO?

We may disclose some of your information to our service providers and to third parties for the purposes set forth above. We do not sell your personal information. Certain disclosures we make to advertising platforms may be considered "sharing" for cross-context behavioral advertising, or "targeted advertising," under some US state privacy laws — see Sections 6(F) and 11.

When we disclose information to our service providers, we endeavor to ensure these service providers provide protections that are the same as, or substantially similar to, those described in this Policy (for example, by limiting the use of your information to the services they provide to us). Our service providers include:

• hosting, database, and cloud storage providers;
• email and text-messaging platforms;
• analytics and product measurement providers;
• tag management and data routing providers, which process website events on our behalf before they are transmitted to the partners described below;
• customer support and ticketing tools;
• anti-cheat, fraud prevention, and content moderation providers; and
• marketing and advertising partners.

Depending on the Supersaurus Services you use and how you interact with them, third parties include:

• Gaming platforms and storefronts (for example, Steam) that host, distribute, or enable purchases of our games, to enable the transaction and product features. When we send you to the Steam store page from our website, the web address includes our campaign parameters (such as utm_source) so that Steam can tell us, in aggregate, how many wishlists our campaigns produced; it does not include advertising click identifiers;
• Advertising platforms (currently Meta, Google and YouTube, and Reddit), to measure the performance of our advertising campaigns and to deliver advertising. This may include sharing identifiers such as advertising click identifiers, cookie identifiers, IP address, and a cryptographically hashed form of your email address, so that the platform can match a sign-up to an advertisement you saw or clicked. You may opt out at any time as described in Sections 6(G) and 9, and we do not do this if you have opted out;
• Community platforms (for example, Discord) that host our official community spaces;
• Professional advisers, such as our lawyers, auditors, and insurers; and
• Law enforcement, regulators, and other parties where we believe in good faith that disclosure is necessary to comply with a legal obligation, protect the rights, property, or safety of Supersaurus, our users, or the public, or to establish, exercise, or defend legal claims.

We may also disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business. We will notify you of any such change in ownership or control of your personal information as required by applicable law.

6. HOW DO WE USE COOKIES AND SIMILAR TECHNOLOGIES?

A. What is a cookie?

A cookie is a small file placed onto your device that enables a variety of features and functionality. Cookies can be read and written by websites, which allows a website to recognize you and remember information that makes your use of the site more convenient (for example, by remembering preference settings).

We also use other technologies that do similar jobs. In this section, when we say "cookies" we mean cookies and these similar technologies, which include:

• Pixels and tags — tiny pieces of code, often invisible, that record that a page was loaded or an action was taken.
• Local storage — a place in your browser where a site can store information, similar to a cookie but usually larger and longer-lived.
• Software development kits (SDKs) — code built into an application that performs the same functions as cookies and pixels do on the web.
• Server-side event collection — where information about your visit is sent to our own servers first, and from there to the partners described in Section 6(F). See Section 6(E), because this one is easy to misunderstand.

B. When do we place cookies, and what choices do you have?

We place cookies when you visit our websites. Most are set when you arrive.

We do not put a consent banner in front of you, and here is why. Our services are directed to users in the United States, where the law works on a notice-and-opt-out basis rather than an ask-first basis. So instead of a pop-up, we do two things: we tell you plainly what runs and who receives the information (Sections 6(D) and 6(F)), and we give you a way to turn off the advertising side of it that works immediately and keeps working (Sections 6(G) and 6(H)).

• Strictly necessary cookies are set when you arrive, because the site cannot work without them. This includes the cookie that records your opt-out — we have to remember your choice in order to keep respecting it.
• Analytics and advertising cookies are also set when you arrive, unless you have opted out or your browser sends a Global Privacy Control signal. We would rather say that plainly than bury it.
• If you opt out, we stop sending information about your visit to our advertising partners — immediately, for that browser, and for future visits in that browser. Section 6(G) explains how, and Section 6(H) explains the browser signal.

The control that matters is "Do Not Sell or Share My Personal Information." It is in the footer of every page. Using it stops all transmission of information about your visit to our advertising partners. If your browser sends a Global Privacy Control signal, we treat that as the same request and you do not need to click anything at all.

What opting out does and does not do. It stops us transmitting information about you to Meta, Google, and Reddit. It does not erase transmissions that already happened before you opted out, and it does not stop us collecting information you give us directly — for example, if you type your email address into our sign-up form, we have it, and opting out of advertising does not delete it. If you want that deleted, ask us (Section 12).

C. What types of cookies do we use?

• Strictly Necessary Cookies. Necessary for the website to work and to enable you to move around it and use its features. Without these cookies, the site will not perform as intended and we may not be able to provide certain services or features you request. These include the cookie that records your opt-out choice, and cookies used for security and load balancing.
• Functionality Cookies. Collect information about your choices and preferences, and allow us to remember language or other local settings and customize the site accordingly.
• Analytics Cookies. Collect information about your use of our sites and enable us to improve the way they work — for example, by showing us which pages are most frequently visited, helping us record difficulties you encounter, and showing us whether our advertising is effective. This lets us see overall patterns of usage rather than the activity of a single person.
• Advertising Cookies. Used for marketing purposes, including to measure the effectiveness of our advertising campaigns and to help advertising platforms deliver advertising that is more relevant to you. Section 6(F) explains this in more detail.

All of the cookies above are either persistent cookies or session cookies. A persistent cookie helps us recognize you as an existing user, so it is easier to return to our sites or interact with them repeatedly; it stays in your browser and will be read when you return. Session cookies only last for as long as the session — usually the current visit to a website or a browser session.

D. Which specific cookies do we use?

The names and lifetimes of cookies set by our advertising and analytics partners are set by those partners and may change; the lifetimes below are taken from each partner's published documentation.

E. Cookies, pixels, and collection that happens on our servers

Some of the technologies described in this section do not run entirely inside your browser. Instead, information about your visit is sent to our own servers, and from there to the partners described in Section 6(F). This is sometimes called server-side tagging.

We mention it because it is easy to assume it means something it does not:

• It does not mean we collect less. The same events and identifiers are involved.
• It does not mean cookies are no longer used. Cookies are still written to and read from your device; some of them are set by our own domain rather than by the partner's.
• It does not change your choices, and this is the important one. An opt-out that only silenced the code running in your browser would be theatre, because the information would still flow from our servers to the advertising platforms. So the check is not in the browser. It sits at the point where our servers hand information to a partner, and if you have opted out — or your browser sent a Global Privacy Control signal — nothing is sent at all: no email address in any form, no advertising identifiers, no record of what you did on the site. Your opt-out applies to both sides, and it is enforced on the server side.

F. How are cookies used for advertising purposes?

Cookies and other advertising technologies such as beacons, pixels, and tags help us measure and deliver advertising more effectively. They also help us produce aggregated auditing, research, and reporting, understand and improve our services, and know when content has been shown to you.

We advertise on third-party platforms, currently including Meta (Facebook and Instagram), Google (including YouTube), and Reddit.

How attribution works, in plain terms. When you click one of our advertisements, the platform adds a short identifier to the web address you arrive at — for example fbclid, gclid, gbraid, wbraid, or rdt_cid. We store that identifier. If you later do something we are measuring, such as signing up for the demo, we send the event back to the platform together with that identifier so the platform can connect your sign-up to the advertisement you clicked.

Hashed email addresses. For the same purpose, we may send the advertising platform a cryptographically hashed version of your email address — a scrambled string produced by a one-way function (SHA-256). We do not send the platform your email address in readable form. However, we want to be straightforward about what this is: the platform can compare that scrambled string against its own records to work out whether you are one of its users. It is a matching key, not anonymization.

If you opt out, none of the above happens. No identifier is sent, no hashed email address is sent, and no event is sent — for that session and for later visits in that browser. See Sections 6(G) and 6(H).

Because your web browser may request advertisements and beacons directly from third-party ad network servers, those networks can view, edit, or set their own cookies, just as if you had requested a web page from their site. We encourage you to read the privacy policies of the advertising platforms we use, and to use the controls those platforms offer over their own advertising.

"Sharing" under US state privacy laws — plainly. We do not sell your personal information, and we do not receive money or anything else of value in exchange for it. What we do is this: we send an advertising platform enough information to recognize you as one of its users, and in return we learn which of our advertisements worked and the platform improves the targeting of the advertisements it shows. Under California law that is "sharing" for cross-context behavioral advertising, and it is "targeted advertising" under the other US state privacy laws that use that term. We give you the opt-out that goes with it, and you can use it in three ways:

• the "Do Not Sell or Share My Personal Information" control in the footer of every page;
• a Global Privacy Control signal from your browser, which we honor automatically (Section 6(H));
• or by asking us (Section 12).

We do not require you to create an account, verify your identity, or give us any information in order to opt out.

G. Controlling cookies and changing your mind

• "Do Not Sell or Share My Personal Information." This is the main control, and it is in the footer of every page. One click. It takes effect immediately, it stops both browser-side and server-side collection for advertising purposes, and it is remembered for future visits in that browser. We do not ask you to create an account, verify who you are, or explain why.
• Global Privacy Control. If your browser or a browser extension sends a GPC signal, you do not need to use the control above — we treat the signal as the same request. See Section 6(H).
• What it covers, honestly. The opt-out is recorded against the browser you are using, using the pu_optout cookie in the table at Section 6(D). That means two things worth knowing: if you use a different browser or device, you will need to opt out there too, and if you clear your cookies you will clear the record of your opt-out along with them.
• What it does not undo. Opting out stops future transmissions. It does not reach back and retrieve information that was already sent to an advertising platform before you opted out.
• We will not pester you to opt back in. If you opt out, we will not ask you to reverse that decision for at least twelve months.
• Browser settings. Most browsers allow you to control and erase cookies through their settings. However, if you limit the ability of websites to set cookies, some features may work improperly or not at all, and it may stop you from saving customized settings. Browser settings are a blunt instrument; the opt-out control above is the better tool for choices about our sites.
• Mobile advertising identifiers. Your mobile device settings allow you to limit ad tracking or reset your advertising identifier. On iOS, see your app tracking and advertising settings; on Android, see your ads settings.
• Records of your choice. We keep a record of the opt-out — that you made it, how (by clicking or by browser signal), and when — so that we can show we respected it. See Section 8(B).

H. Browser signals: Global Privacy Control and Do Not Track

These are two different things and are often confused, so we describe them separately.

Global Privacy Control (GPC). GPC is a signal that your browser or a browser extension can send to every site you visit, telling them you do not want your personal information sold or shared. We honor it.

When we detect a GPC signal, we treat it as a request to opt out of the sharing of your personal information, and of targeted advertising, for that browser. You do not need to do anything else — no click, no account, no verification.

Specifically, when we see GPC:

• we do not send any event about your visit to Meta, Google, or Reddit;
• we do not send a hashed version of your email address to any of them;
• we do not send the advertising identifier from the link you clicked to get here;
• and this applies to the collection that happens on our servers, not only to code running in your browser. That distinction is the one that usually goes wrong elsewhere, so we have put the check at the point where information would leave our systems (Section 6(E)).

What GPC does not do. It is an opt-out of sharing, not an instruction to stop the site working. If you send GPC and then type your email address into our sign-up form, we still receive your email address — you gave it to us on purpose. We simply do not pass it to an advertising platform. If you would like us to delete it, ask us (Section 12).

Do Not Track (DNT). DNT is an older browser setting, promoted at one time by regulators and the W3C, intended to let people signal that they did not want to be tracked across sites. No common industry standard for responding to DNT was ever adopted, and we do not respond to DNT signals. This does not affect the GPC signal described above, which we do honor.

I. Other helpful resources

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org.

To learn more about advertisers' use of cookies, and to use industry opt-out tools. These are additional to our own control in Section 6(G), which is the one that actually stops our transmissions:

• Digital Advertising Alliance (US) — YourAdChoices / WebChoices: optout.aboutads.info
• Network Advertising Initiative (US) opt-out: optout.networkadvertising.org
• Interactive Advertising Bureau (US): iab.com

You can also manage advertising preferences directly with the platforms we advertise on, through their own ad settings.

Browser manufacturers provide help pages relating to cookie management in their products:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Safari on Mac
• Safari on iPhone and iPad

We are not affiliated with any of the resources provided above.

7. WHERE DO WE PROCESS INFORMATION?

We are headquartered in the United States, and we and our service providers may process and store your information in the United States and in other countries where we or they operate. These countries may have data protection laws that differ from those in your country.

Our services are directed to users in the United States. If you access them from outside the United States, you do so on your own initiative, and your information will be transferred to and processed in the United States as described in this Policy.

8. HOW DO WE HANDLE AND RETAIN INFORMATION?

A. Security

We use technical and organizational measures designed to protect your information against unauthorized access, disclosure, alteration, and destruction. These include encryption of information in transit and at rest, access controls that limit access to the people who need it to do their jobs, logging and monitoring of access to our systems, and periodic review of these measures.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

B. Retention

We retain your information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. When determining how long to retain information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, whether we can achieve those purposes through other means, and applicable legal requirements.

Our current retention periods are:

9. WHAT CHOICES AND CONTROLS DO YOU HAVE?

• Marketing emails. You can unsubscribe at any time using the link in any marketing email we send you, or by contacting us. We may still send you service-related messages.
• Text messages. If you agreed to receive text messages, you can stop at any time by replying STOP to any message, or by contacting us. Reply HELP for help. Message frequency varies, up to 4 messages per month. Message and data rates may apply. Consent to receive texts is never a condition of signing up or of any purchase.
• Cookies and advertising technologies. See Section 6(G).
• Opting out of targeted advertising. In addition to the "Do Not Sell or Share My Personal Information" control in our footer and the Global Privacy Control signal, you can opt out of interest-based advertising through the industry tools listed in Section 6(I) and through the settings offered by the advertising platforms themselves.
• Your device settings. Your browser and device settings offer additional controls over cookies, location, and advertising identifiers.
• Your privacy rights. Depending on where you live, you may have additional rights over your information. See Section 11. To make a request, contact us using the details in Section 12.

We will not discriminate against you for exercising any of your privacy rights.

10. WILL THIS POLICY BE UPDATED?

Please take a look at the "Last Updated" date at the top of this Policy to see when it was last revised. Any changes to this Policy will become effective when we make the revised Policy available on or through the Supersaurus Services. Where required by applicable law, we will provide you with additional notice and, where necessary, obtain your consent. Please note that the names and functionality of cookies, pixels, and other technologies may change over time.

11. ADDITIONAL NOTICE FOR RESIDENTS OF CERTAIN US STATES

A. For California Residents

The California Consumer Privacy Act, as amended (CCPA), requires us to provide residents of California with information regarding their personal information in a specific format. Terms used in this subsection are defined by the CCPA.

If you are a California resident, you have the right to:

• know and access what personal information we collect about you, including the categories of personal information collected and their sources, the business or commercial purposes for collection, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information collected;
• correct inaccurate personal information;
• delete your personal information;
• opt out of the sale or sharing of your personal information; and
• not receive discriminatory treatment for exercising these rights.

Sensitive personal information. We do not collect sensitive personal information as defined by the CCPA. We do not collect government identifiers, financial account or payment card details, precise geolocation, health information, biometric information, or information about racial or ethnic origin, religion, or sexual orientation.

Categories of personal information we collect, disclose, and share. In the preceding 12 months we have collected the following categories of personal information. We do not sell personal information. Retention periods are in Section 8(B).

Sale and sharing. We do not sell your personal information. Our use of the advertising technologies described in Section 6 constitutes "sharing" for cross-context behavioral advertising under the CCPA. You may opt out via the "Do Not Sell or Share My Personal Information" link in the footer of every page, by setting a Global Privacy Control signal in your browser, or by contacting us.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

How to submit a request. You may submit a request to know, access, correct, or delete by emailing us at privacy@supersaurus.com or by writing to us at the postal address in Section 12. We will verify your request by matching the information you provide against the information we hold, and we may ask you to confirm the request from the email address on file. We will respond within the time required by law.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We may require verification of the agent's authority and of your identity.

B. For Residents of Other US States

If you live in a US state with a comprehensive consumer privacy law, you may have rights that include the right to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We honor these rights for residents of every state that provides them. To exercise them, contact us using the details in Section 12. Where applicable law provides a right to appeal a denied request, you may appeal by contacting us at the same address, and we will respond within the period required by that law.

12. HOW CAN YOU CONTACT US?

If you have questions about this Policy or wish to exercise your privacy rights, you can contact us at:

Supersaurus, Inc. Attn: Privacy Team 9423 Piplio St San Diego, CA 92129 Email: privacy@supersaurus.com

Our Privacy Team is responsible for acknowledging and resolving privacy requests within the timeframes required by applicable law. Requests may be submitted by email or by post; we do not require you to create an account to make a request.