Privacy Policy

This Privacy Policy of Middle-earth Enterprises, LLC applies to you if you are located in the United States. If you are located outside the United States, please see the General Privacy Policy.

U.S. Privacy Policy

Last Updated: July 20, 2026

1. Introduction

This Privacy Policy describes how Middle-earth Enterprises, LLC (the “Company,” or “we,” “our,” or “us”) collects, uses, and shares information in connection with your use of the Lord of the Rings Fan Club website at https://lotr.com (or any subsequent URL which may replace it) and any Company operated subdomains, directories and subdirectories of such site that link to or expressly incorporate this Privacy Policy (the “Site”) and all features, functions, software and services offered through this Site. Our Site and the features, functions, software, publications and services offered through our Site collectively constitute our “Services”.

This Privacy Policy does not apply to information collected by third parties that may interact with our Services (e.g., a social media plug-in), or to our data collection activities outside of our Services (e.g., through websites that support specific products, which may have different privacy policies). It also does not apply to information collected through the Services if you are located outside of the U.S.

If you do not agree with something stated in this Privacy Policy, do not continue to use the Services.

2. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. It does not include information that is publicly available as defined by applicable law, deidentified or aggregated information, or information outside the scope of applicable privacy laws.

Information You Provide

Contact details: Name, email address, mailing address, telephone number, and other contact details you choose to provide.
User account details: Current and prior usernames, the email address or mobile phone number to which we send one-time sign-in codes, account or user ID, age-screen result (see Section 12), and other information used to create, authenticate, secure, and administer your account.
Correspondence: Communications you send to us, including support inquiries, complaints, moderation appeals, reports, legal requests, and communications with a Website administrator.
Optional profile information: Biography, coarsened location, interests, language, social links, favorite works or characters, reading or viewing lists, and similar text-based information you choose to add to your account or profile.
Content and interactions: Posts, replies, comments, reviews, reactions, submissions, survey responses, reports, other text-based content you create, and messages you send to MEE or a Website administrator. The Services do not offer private messaging between users. The account Messages area is used only for communications between MEE or a Website administrator and an individual user, including communications about account administration, support, moderation, safety, or violations. Public posts are public; Administrator Communications are not public but may be accessed and retained by authorized personnel for the purposes described in this Policy.
Privacy choices and consent records: Your privacy settings, marketing choices, cookie choices, consent or withdrawal records, the version of the notice or consent presented, timestamps, and related technical or account information.
Waitlist and invitation records: Contact details, signup time, referral or campaign source, invitation status, eligibility, and related records used to administer a staged Public Beta rollout.
Reward, entitlement, and anti-abuse records: Mathoms, points, badges, completed challenges, earned entitlements, and limited records used to prevent duplicate rewards, fraud, or abuse.

Information Collected Automatically

Security and request data: IP address, request and event timestamps, authentication and security events, logs, diagnostics, and information used to detect fraud, abuse, or violations.
Browser and device data: Device identifiers, device type, operating system, browser type and version, language, time zone, cookie identifiers, and technical settings.
Use and participation data: Pages and text-based content viewed, searches, clicks, referral and exit pages, session activity, posts, replies, reactions, game plays, survey answers, activity history, reading or viewing lists, personalization choices, feature participation, progress events, and coarsened location shares.
Analytics data: If you give Analytics consent, we use Google Analytics to collect usage analytics such as pages viewed, events, session information, approximate location derived from technical signals, browser and device information, and first-party analytics cookies or similar identifiers. Google Analytics does not load unless you have given Analytics consent. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of optional analytics and similar non-essential technologies unless you later make a more specific choice through our controls.
Referral attribution: If you arrive through a member or partner referral link, we may set a first-party referral cookie or similar identifier that remembers the referral source for up to 30 days so the referring member or partner can be credited. Where required by applicable law, we set this cookie only with your consent. Referral attribution does not include checkout, payment, order, delivery, or return information.
Bug-report metadata: Browser and device metadata and diagnostic information associated with a bug report. The free-text description and email address are sent only if you choose to submit the report.
Location data: Approximate location may be inferred from technical data. If you enable a location-based feature, exact coordinates are used transiently to obtain a place label and are not stored; only a coarsened location, approximately 11 kilometers, is stored until you disable the feature or delete your account.

Sensitive Personal Information and special-category data: We do not request or permit information about racial or ethnic origin, religious or philosophical beliefs, union membership, health, genetic or biometric identifiers, sex life or sexual orientation, citizenship or immigration status, or other sensitive information in profiles, posts, surveys, Administrator Communications, bug reports, or other submissions. Do not submit such information about yourself or another person. We use account-access information only for authentication, security, and service integrity, and process precise geolocation only transiently for a location feature you enable. If prohibited sensitive information is detected, we may remove it and retain only what is reasonably necessary for safety, legal compliance, or legal claims.

Challenge proof images: Only where a designated online contest or challenge requests photographic proof may you upload a photo or screenshot to confirm that you completed the requested task. The image is a private verification input, is not public User Content, and is never displayed to other users. We may send it to Anthropic, our artificial-intelligence provider, solely to check whether it shows the challenge task. A passing check may approve completion automatically; anything else is sent to an authorized human reviewer. The proof images are not made public and are deleted from MEE’s systems within 24 hours after a decision is made; Anthropic ordinarily deletes API inputs and outputs from its backend within 30 days. Anthropic does not use it to train its models. MEE may retain the resulting completion decision, reward, and limited anti-abuse record, but not the proof image itself. Do not include identification documents, personal financial information, intimate imagery, other sensitive or unlawful material, or material unrelated to the requested challenge. In a personal photograph taken by you or on your behalf, do not depict anyone under 18 other than yourself, and do not depict any other identifiable person unless you have that person’s permission. The restrictions in the preceding sentence do not apply to people or fictional characters depicted in pre-existing films, television programs, games, or other content lawfully made available to the public, provided that you are otherwise permitted by applicable law to submit that content.

Mandatory and optional information. Certain fields are required for us to provide a requested feature or service. For example, creating an account requires an email address or mobile phone number to which we send one-time sign-in codes, and username; contacting us or an administrator requires enough information to respond. Where information is optional, we identify it as such or the feature can be used without providing it. If you do not provide required information, we may be unable to create the account, respond to the request, or provide the relevant feature.

We may use information that does not identify you, such as aggregated or deidentified information, for any lawful purpose and will not attempt to reidentify deidentified information except as permitted by law.

3. SOURCES OF PERSONAL INFORMATION

We collect Personal Information directly from you; automatically from your browser, device, and use of the Services; from service providers acting on our behalf; and from referral links, campaigns, or partners that direct you to the Services. If you connect or interact with a third-party service, we may receive information that you direct that service to provide, subject to that service’s settings and privacy terms.

4. How We Use the Information We Collect from You

We will only collect and use your information to achieve the purposes stated in this Privacy Policy.

The purposes for collecting and using your information include the following:

To provide you the Services, by authenticating your login information, verifying your age, remembering your settings, and hosting and providing backend infrastructure for our Site.
To create, maintain, customize, and secure your user account on the Site.
To improve or develop the Services, including by optimizing traffic, conducting analytics, and research, landing pages, and heat mapping the Site.
To market our business and to communicate with you regarding promotions and sales, upcoming events, news on products and the Services and to analyze the effectiveness of such advertisements.
To send information to you, including confirmations, updates, and administrative messages.
To communicate with you when you message us, respond to our posts, or otherwise interact with us on social media platforms.
To arrange events and contests.
To provide club participation features, such as rewards, badges, challenges, games, and activity history, and optional features you choose to enable, such as birthday features where offered, the coarsened-location member map, your public profile fields, and private proof-image verification for designated contests or challenges, based on the Personalization choice or the specific feature you enable in Privacy settings (https://www.lotr.com/privacy-settings).
To review content you post on the Services (such as community posts, replies, and submissions) for compliance with our Community Guidelines (set out in our Terms of Service), using automated moderation before publication (see “Automated Content Moderation” below).
To provide and develop our customer service and support, answer questions and manage complaints.
To safeguard and defend the rights of our business, for example in case of a legal process, and to investigate and respond to fraudulent, unauthorized, or illegal activity on the Services.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding.
For purposes disclosed at the time you provide your information or as otherwise set forth in this Privacy Policy.

Automated Content Moderation: When you post text on our Services (such as community posts, replies, and submissions), the content of your post and limited account information (such as your username and user ID) are automatically reviewed before publication for compliance with our Community Guidelines (set out in our Terms of Service). This review is performed by an artificial intelligence service provided by Anthropic, which acts as our service provider under a written contract that restricts its use of this information to providing the moderation service to us and prohibits use of your content to train its models.

If your post does not pass the automated review, it will not be published. You will be informed of the reason and may rephrase and resubmit your post, and you may request review of the decision by a member of our team directly within the Services: each moderation decision includes an option to ask for a second look, and our team’s reply is delivered to the Messages area of your account. Certain moderation processes also include human review by default. We use this information only to moderate content — not to build a profile of you or for advertising — and we do not sell or share it. Account-level actions, such as suspension, are taken only with human involvement.

Text that does not pass the automated review is not published and is not saved in MEE’s public-content database. Anthropic ordinarily deletes API inputs and outputs from its backend within 30 days, but may retain information longer where necessary to enforce its Usage Policy, including for content flagged by its safety systems, or where required by law. Our contract prohibits Anthropic from using your content to train its models. If you request human review, MEE retains the text as part of the related Administrator Communication and moderation record. Submissions that queue for human review and are not accepted are deleted from MEE’s active systems within 30 days of the decision, subject to limited legal, safety, and backup exceptions described in Section 5.

When you submit a photo or screenshot to complete a designated online contest or challenge, we may send the image to Anthropic solely to check whether it shows the requested task. A passing check may approve your completion automatically; anything else is sent to an authorized human reviewer. The proof image is not made public and is deleted after a decision is made. Anthropic does not use it to train its models. MEE may retain the resulting completion decision, reward, and limited anti-abuse record, but not the proof image itself.

5. How Long Do We Store Information?

We retain each category only for as long as reasonably necessary for the disclosed purpose. Core account information is retained while the account is active and afterward only as needed for security, legal compliance, disputes, and recordkeeping. Participation data is retained until you use the deletion control, withdraw the relevant choice, or delete the account; active-system deletion is described in Section 7. Earned reward and entitlement records are retained while the account is active and deleted with the account. Waitlist and invitation records are retained until you withdraw, accept access and create an account, or the relevant rollout is complete and the record is no longer needed. Prior usernames are retained while the account is active for community safety and are deleted with the account unless linked to an ongoing safety, fraud, legal, or dispute matter. Referral identifiers expire after no more than 30 days. Precise coordinates are used transiently; a coarsened location is retained until you disable the feature or delete the account. Security, diagnostic, and duplicate-reward records are retained only for the limited period reasonably necessary to protect the Services and prevent abuse. Administrator Communications, support, moderation, and complaint records are retained for as long as reasonably necessary to resolve the matter, protect users, enforce our terms, and comply with law. Privacy-choice and consent evidence is retained for as long as needed to honor the choice and demonstrate compliance, generally no longer than seven years unless a longer period is required. Marketing data is retained until you opt out. Analytics is retained under the applicable settings and provider terms and, where possible, in aggregated or deidentified form. Automated moderation retention is described in Section 4. Challenge proof photos and screenshots are deleted after the verification decision; the resulting completion decision, reward, and limited anti-abuse record may be retained separately as described above. Limited backup copies remain only until overwritten through the normal backup cycle.

6. How We Share Information

We share information we collect with selected third parties, in accordance with the practices described in this Privacy Policy.

The categories of parties with whom we share information, and have shared information in the past 12 months, include:

Service Providers: We use service providers to help support and operate the Services or perform functions on our behalf, including database, authentication, transient challenge-proof image processing, website hosting and delivery, transactional email and SMS sign-in code delivery, analytics engaged only with your consent, Anthropic for text moderation and challenge-proof verification, security, support, and marketing. We provide only information reasonably necessary for the contracted service and require appropriate confidentiality, security, deletion, and use restrictions, subject to applicable law and the provider-specific retention described in this Policy.

Features That Connect Directly to Third Parties: Some features of the Services cause your browser to communicate directly with third-party providers: when you use the location feature, your browser sends your precise coordinates to a reverse-geocoding service provider (we then coarsen the result to an approximate location before storage, as described above); and when you view the member map, the map tiles load from a third-party map provider’s content delivery network, so your IP address reaches that provider’s servers.

Merchandise links and third-party sellers: MEE acts only as a referral source for merchandise. If you follow a merchandise link, you leave the Services and any purchase is made directly from the third-party seller through the seller’s own store, which may use Shopify or another commerce provider. MEE is not the seller or merchant of record and does not handle checkout, payment, order fulfillment, shipping, returns, or refunds. MEE does not receive your checkout, payment, order, delivery, or return information from the seller unless you separately choose to provide information to MEE in a support or other communication. The seller’s and commerce provider’s privacy terms apply to their processing. Referral attribution information described in Section 2 may be used to identify the source of a link, but it does not include checkout or payment information.

Business Partners: We may share your information with companies within our corporate group that support the Services, which handle it consistently with this Privacy Policy, and with co-sponsors or administrators of a contest or survey you choose to enter, who are identified in the applicable contest or survey terms and may use your information only to administer that contest or survey. We do not permit these recipients to use your information for their own marketing unless you expressly opt in. Companies that help us develop or operate the Services receive information as Service Providers, as described above.

Administrative and Legal Disclosures: We may disclose your information to third parties: (i) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; (ii) to satisfy any applicable law, regulation, subpoena, or governmental request or legal process, or any legal process in connection with a court proceeding or arbitration, if in our good faith opinion we are required or permitted to do so by law; (iii) to investigate potential violations of policies or terms applicable to the Services; (iv) to protect the safety, rights, property or security of the Services, our staff, users, or any other third party; or (v) to detect, prevent, or otherwise address fraud or threats to security.

Business Transfers: We may share your information with our affiliate companies within and outside of the U.S. In the event some or all of our company is acquired by another party, we may share your information with the acquiring party.

We may also share your information in certain other situations, according to the following:

Consent: We may share your information for other purposes if we have disclosed that purpose to you and you have consented to it.

Third-Party Locations and Services: When you are on the Site, you may be directed to other sites or services that are operated by third parties outside of our control. For example, if you click on a link displayed on the Site, you may be taken to a different site. We may share information with that site at your request or direction. We are not responsible for the data collection and privacy practices employed by these third parties. We encourage you to pay attention when you leave our Site and to review the privacy policies of any third-party locations you go to.

7. Your Choices and Control

There are various ways in which you can exercise choice and control over the information you provide to us on the Services. Here are some examples:

Limit the Information You Provide to Us: You can stop all prospective collection of information on our Services by ceasing to interact with the Services. You can also decline to provide information we request from you, although doing so may prevent you from using certain parts of the Services.

Change Your Communications Preferences: You may cancel or modify the email communications you receive from us by following the instructions contained within our promotional emails or, where applicable, by logging into your account and adjusting your settings. This will not affect subsequent access to the Services. Please note that we reserve the right to send you certain communications relating to your account or use of our Services.

Do Not Track: Your browser settings may allow you to automatically transmit a “Do Not Track” signal to websites and online services you visit. There is no consensus among industry participants as to what “Do Not Track” means in this context. Like many websites and online services, unless and until the law is interpreted to require us to do so, we do not alter our practices when we receive a “Do Not Track” signal from a visitor’s browser. To learn more about “Do Not Track,” you may wish to visit https://www.eff.org/issues/do-not-track.

Cookies: For a full, itemized list of the cookies we set — name, purpose, category, and duration — see our Cookies Policy. You can always withdraw or update your consent to our use of optional cookies and similar technologies through Privacy settings. You can also manage cookies in your browser settings.

Privacy Settings and Participation Data: You can withdraw or update optional choices, such as Personalization and Analytics, at any time through Privacy settings, and you can erase participation data there without contacting us. “Participation data” means your activity within the club: posts, replies, reactions, game plays, survey answers, activity history, and coarsened location shares. The “Delete my participation data” control removes that information from your active account and MEE’s active systems immediately and stops its use for participation or personalization. It does not remove things you have earned (including Mathoms, points, badges, and completed challenges), records of your privacy and consent choices, prior usernames kept for community safety, messages you sent to MEE or a Website administrator and related support or moderation records, your waitlist and invitation record, or short-lived security and anti-abuse records used to prevent duplicate rewards. Those excluded records are retained separately for the purposes and periods described in Section 5. Earned reward and entitlement records are deleted when your account is deleted. Other excluded records are also deleted or deidentified when no longer needed, although limited records may be retained after account deletion where reasonably necessary for legal compliance, security, fraud or abuse prevention, dispute resolution, protection of users, or demonstrating consent. Limited backup copies may remain until overwritten through our normal backup cycle.

We will honor your opt-out preferences if you enact the Global Privacy Control (GPC) opt-out signal on your browser.

8. Your Rights

Accounts and Forums:

You may review, correct, update, or request the erasure of account information you have provided to us by contacting us by email at the address listed in the section “Contact Details” below. We may require additional information from you to allow us to confirm your identity and properly respond to your request. Nothing in this Privacy Policy is intended to limit any additional rights you may have under local law.

Please note that it is not always possible to completely remove or delete all of your account information from our databases and residual data may remain on backup media. Also, we will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Your Nevada Privacy Rights

Nevada law (NRS 603A.340) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of personal information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of personal information for monetary consideration by the business to a third party for the third party to license or sell personal information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please contact us by email at the address listed in the section “Contact Details” below.

9. Your California Privacy Rights

This section describes the various rights California residents have over their personal information under the California Consumer Privacy Act of 2018 (“CCPA”) and how you can invoke these rights with us.

Notice at Collection

Consistent with Section 2, we collect the California Personal Information categories described in the crosswalk below. We collect them directly from you; automatically from your browser, device, and use of the Services; from service providers acting on our behalf; from referral links, campaigns, or partners; and from third-party services when you direct those services to provide information to us. We use them for the purposes described in Section 4. We will provide any just-in-time notice required by applicable law, including before collecting precise geolocation.

We do not sell California Personal Information and do not share it for cross-context behavioral advertising. We do not retain a category longer than reasonably necessary for the disclosed purposes. The retention descriptions below are subject to legal holds, security needs, disputes, and applicable law.

California Disclosure Crosswalk

Category and examples	Sources	Purposes	Retention	Business-purpose recipients
Identifiers and customer-record information, including name, contact details, username, account/user ID, IP address, device/cookie identifiers, and account-access information such as one-time sign-in codes. Account-access information is treated as sensitive Personal Information and used only for authentication, security, and service integrity.	You; browser/device; service providers.	Account creation and authentication; service delivery; communications; support; security, fraud prevention, legal compliance, and rights protection.	Core account information while active and afterward only as reasonably necessary for security, legal, dispute, and recordkeeping purposes. One-time codes are retained only as needed for authentication and security. Technical identifiers follow shorter security and diagnostic periods.	Hosting, authentication, communications, security and support providers; legal and regulatory recipients; affiliates and transaction counterparties where necessary.
Characteristics of protected classifications, including age information and optional birthday information. This may include information concerning users aged 13–15.	You.	Age eligibility, child-safety compliance, and optional birthday features you request.	Eligibility input is evaluated transiently and discarded. Optional birthday information is retained while the feature is active or until you delete it or withdraw, subject to law.	Hosting/authentication providers and legal or regulatory recipients where necessary.
Internet or other electronic-network activity, including pages/content viewed, searches, clicks, sessions, referrals, cookie/device data, security events, feature participation, analytics, and referral attribution.	Browser/device; use of Services; referral links/partners; service providers.	Operate, secure, troubleshoot and improve the Services; optional analytics and heat mapping with consent; participation features; referral attribution; marketing measurement where permitted.	Security and diagnostic records only as reasonably necessary; analytics under consent settings and provider terms; referral identifiers up to 30 days; participation data until deletion through Privacy settings, withdrawal of the relevant choice, or account deletion, subject to normal backup overwrite.	Hosting, security, analytics and marketing providers; referral/contest/survey partners as applicable; map/CDN providers; legal recipients; affiliates and transaction counterparties.
Geolocation, including sensitive precise geolocation. Approximate location may be inferred from technical data; exact coordinates are processed only when you enable the location feature and are sent to the reverse-geocoding provider.	Browser/device; you when enabling the feature.	Provide the requested location or member-map feature and protect the feature from misuse. Precise location is not used for advertising or unrelated profiling.	Exact coordinates are used transiently and are not stored by MEE. MEE stores only a coarsened location of approximately 11 kilometers until you disable the feature or delete the account, subject to limited backups and legal requirements.	Reverse-geocoding provider; hosting provider for the coarsened result; map/CDN provider receives ordinary browser-request information when the map loads.
Audio, electronic, visual, and user-content information, including private challenge proof photos or screenshots, text-based posts, replies, reviews, reactions, submissions, bug reports, correspondence, moderation appeals, and Administrator Communications. Challenge proof images are not public User Content.	You; other users where they mention or report you in text-based content; social platforms when you interact with MEE.	Verify completion of a designated contest or challenge; moderate public text; provide support; protect safety; comply with law; resolve complaints; and operate or improve the Services.	Challenge proof photos or screenshots are deleted after the completion decision; the decision, reward, and limited anti-abuse record may be retained separately. Public text-based content is retained until deletion or account closure, subject to backups, third-party copies, and legal needs. Administrator Communications, support, and moderation records are retained only as reasonably necessary; automated moderation data follows Section 4.	Anthropic and authorized human reviewers for private challenge-proof verification; public and other users only for public text-based content; hosting, moderation, support, and communications providers; legal recipients; affiliates and transaction counterparties where necessary.
Preferences, participation data, rewards, and inferences, including reading/viewing lists, survey or fan-profile responses, posts, replies, reactions, games, activity history, coarsened location shares, earned Mathoms, points, badges, completed challenges, interests, marketing preferences, and personalization generated through enabled features.	You; use of Services; optional analytics with consent.	Personalization and club participation; requested surveys/contests; communications and marketing choices; service improvement.	Participation data until deleted through Privacy settings, the relevant choice is withdrawn, or the account is deleted; earned reward and entitlement records while the account is active and deleted with the account; short-lived anti-abuse records only as reasonably necessary; normal backup overwrite may take longer.	Hosting and participation providers; analytics/marketing providers with consent; contest/survey partners; affiliates and transaction counterparties.
Privacy choices and consent records, including consent, opt-out, withdrawal, cookie-choice and notice-version records.	You; browser/device; consent-management and service providers.	Apply and honor choices; demonstrate compliance; respond to privacy requests and regulator inquiries.	For as long as reasonably necessary to honor the choice and demonstrate compliance, generally up to seven years unless a shorter period is sufficient.	Hosting and consent-management providers; legal advisers, regulators and authorities where required; affiliates and transaction counterparties where necessary.

For all categories above, MEE has not sold Personal Information or shared it for cross-context behavioral advertising in the preceding 12 months. We disclose only the categories reasonably necessary for the recipient’s stated business purpose, subject to applicable contractual and legal restrictions. Section 6 provides additional information about these recipient categories.

Your California Consumer Rights

You have the right to know certain details about our data practices, including information covering the 12 months preceding your request. For Personal Information collected on or after January 1, 2022, you may request disclosure beyond that 12-month period. We will provide the requested earlier-period information unless doing so proves impossible or would involve disproportionate effort, in which case we will provide the explanation required by applicable law. In particular, you may request copies of the following from us:

The categories of CA Personal Information we collected about you;
The categories of sources from which the CA Personal Information was collected;
The categories of CA Personal Information we disclosed for a business purpose or sold;
The business or commercial purpose of our use of your CA Personal Information;
The categories of third parties with whom we share your CA Personal Information; and
The specific pieces of CA Personal Information we have collected about you.

You also have the right to request that we delete your CA Personal Information. We have a right to deny your request under certain circumstances.

You also have the right to request that we correct inaccurate CA Personal Information that we maintain about you.

You can also erase your participation data immediately yourself using the “Delete my participation data” control in Privacy settings, and you can correct much of your information directly in your profile settings, without needing to submit a request.

To exercise a California right to know, access, delete, or correct, submit a request through our privacy-request webform or email the address listed in Contact Details and specify the right and scope of the request. You may use either method. We will confirm receipt within 10 business days and respond within 45 calendar days after receipt. If reasonably necessary, we may extend the response period once by an additional 45 calendar days and will notify you of the extension and reason within the initial period. We may request information reasonably necessary to verify your identity. If we cannot verify the request, we may deny it as permitted by law and explain the basis. Available account and Privacy settings also allow you to initiate certain corrections, deletions, and choice changes directly.

Your Right to Opt-out of the “Sale” or “Sharing” of CA Personal Information

We do not currently sell or share California Personal Information. If our practices change, we will provide the notice and opt-out method required by law before beginning that activity. We honor a qualifying Global Privacy Control browser signal as a valid opt-out preference signal.

Authorized Agent

You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

Your Right to Non-Discrimination

You have the right not to be discriminated against in service or price if you exercise your privacy rights.

Shine the Light

Customers who are residents of California may request (i) a list of the categories of CA Personal Information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To submit a request, please write us at the email or postal address set out in the section “Contact Details” below and specify that you are making a “California Shine the Light Request.” We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during each calendar year.

10. Additional U.S. State Privacy Rights

If you reside in a U.S. state with an applicable comprehensive consumer-privacy law, you may have rights, subject to that law’s scope and exceptions, to confirm whether we process your Personal Information; access, correct, or delete it; obtain a portable copy; obtain a list of third parties to which we disclosed it where required; and opt out of a sale, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects.

We do not currently sell Personal Information, process it for targeted advertising, or use profiling to make decisions that produce legal or similarly significant effects. We will provide any notice and opt-out control required by applicable law before beginning such a practice.

To exercise an applicable state right, email the address in Contact Details and identify your state, the right you wish to exercise, and the scope of the request. We may take reasonable steps to authenticate the request and may permit an authorized agent where required by law. We will respond within the time required by applicable law. If we deny a request, you may appeal by replying to our decision or emailing the same address with the subject line “Privacy Appeal.” We will decide the appeal and provide any regulator-contact information required by your state’s law.

11. International Transfers of Information

Please be aware that information we collect may be transferred, processed, stored, and used internationally, including in Canada, the United Kingdom, and countries in the European Union. The data protection laws in these countries may differ from those in the U.S., and your information may be subject to access requests from governments, courts, or law enforcement. Where international transfers are necessary, we will take reasonable security measures in order to protect your information.

12. Children’s Information

The Services are intended for a general audience and are not directed to children under 13. Our Terms of Service do not permit anyone under 13, or any higher minimum age required by applicable law, to use the Services. We do not knowingly collect or maintain personal information, as defined by the Children’s Online Privacy Protection Act (“COPPA”), from children under 13. If we learn that we have collected or maintained personal information from a child under 13, we will promptly delete that information, disable the child’s account where applicable, and, as applicable, instruct our service providers to delete the information, unless retention of limited information is required or permitted by applicable law.

When you create an account, we use a neutral age screen and ask for birth month and year solely to determine whether you meet the minimum age. The age input is evaluated for that check and then discarded; it is not stored. If the age screen or other information indicates that a user is under 13, we treat that information as actual knowledge for purposes of our response: we block account creation and further collection, promptly delete any Personal Information already received unless limited retention is permitted or required by law, and, as applicable, instruct our service providers to delete it. A failed age check sets a temporary cookie for 24 hours solely to prevent repeated attempts. The optional birthday feature will not accept information indicating that a user is below the minimum age.

We do not knowingly “sell” or “share,” as those terms are defined under the CCPA, the CA Personal Information of California residents under 16.

If you are a parent or guardian and believe that a child under 13 has provided personal information to us, please contact us using the details in the “Contact Details” section below. We may take reasonable steps to verify that you are the parent or guardian. After verification, we will take appropriate action, including deleting the child’s personal information from our records and, as applicable, instructing our service providers to delete it, unless retention of limited information is required or permitted by applicable law.

13. Keeping the Information Secure

We understand how important data security is to you, and we have implemented various policies, processes, and technical measures to help protect and secure your information. That said, no data transmission is guaranteed to be 100% secure. Please take care when transmitting information online, including through the Services, and make sure to always keep your account information secure. In the event we become aware of a data breach involving unencrypted notice-triggering information in our possession, we will notify you as may be required by applicable law.

14. Contact Details

If you have any questions, wish to file a complaint, or wish to make any request authorized by this Privacy Policy, please contact us at the following address or email:

Email: info@middleearth.com

3142 Constitution Dr., Livermore, California 94551

This Privacy Policy has been designed to be accessible to people with disabilities. If you experience any difficulties accessing the information here, please contact us at the email address stated above.

Changes to This Privacy Policy

We reserve the right to change this Privacy Policy. Any changes to this Privacy Policy will be effective as soon as we post them. However, if you have registered an account with us, we may ask you to opt-in upon sign-in if we make material changes, to the extent required by applicable law.