Junebug Security & Data Breach Notification Statement

Playtime Planning LLC dba Junebug ("Junebug," "we," "us," or "our") is committed to protecting the personal information entrusted to us. Junebug is a two-sided network that connects parents and caregivers ("Users") with children's activity providers ("Providers"). This Security & Data Breach Notification Statement describes the reasonable safeguards we maintain and how we respond to and provide notice of certain security incidents involving the Junebug mobile application, website, and related services (collectively, the "Platform"). This Statement supplements our Privacy Policy.

Junebug employs reasonable technical and organizational safeguards to protect personal information, including:

• Encryption of data in transit and at rest;
• Access controls restricting access to systems;
• Secured file storage; automated screening of uploaded content; and rate limiting.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Junebug does not charge Users to use the platform and does not collect payment information from User accounts. If Junebug introduces paid provider subscriptions, payment transactions will be processed by Stripe, Inc., a PCI-DSS compliant payment processor, and Junebug will not store raw payment card data.

A security breach occurs when your unencrypted personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person. Categories of personal information we collect that could be affected include:

• Name, email address, and account credentials
• Child’s name, age, and activity preferences or enrollment information
• Reviews and other content you submit to the platform
• Device identifiers and usage data collected through our app

If a breach compromises your unencrypted personal information, we will notify you without unreasonable delay and in any event within 30 calendar days of discovering or being notified of the breach, as required by California Civil Code § 1798.82. If a breach affects more than 500 California residents, we will submit a sample notice to the California Attorney General within 15 calendar days, consistent with the legitimate needs of law enforcement and measures necessary to determine the scope of the breach and restore the integrity of the system, as required by California Civil Code § 1798.82 and other applicable law.

Notification will be delivered by one or more of the following methods:

• Email to the address associated with your Junebug account
• Prominent notice within the Junebug app or on junebugfamily.com
• Substitute notice where direct notification is not feasible, which may include email to affected users, conspicuous posting on our website, and notification to major statewide media

Our notification will include, to the extent known at the time of notice:

• A description of what happened and the date or estimated date of the breach
• The categories of personal information involved
• What Junebug is doing in response
• Steps you can take to protect yourself
• Contact information for questions

Because Junebug collects information about minors in connection with activity discovery and enrollment, a breach involving a child’s personal information may trigger additional notification obligations under the Children’s Online Privacy Protection Act (COPPA) and the California Age-Appropriate Design Code Act. We will comply with all notification requirements applicable to children’s data.

Junebug uses third-party service providers, including email delivery, cloud infrastructure, and analytics services. If a breach originates with a third-party provider, we will notify you as required by applicable law and cooperate with the provider’s investigation and remediation efforts.

Email: support@junebugfamily.com, Subject line: Security Concern
Mail: P.O. Box 73054, San Clemente, CA 92673

We will review all reports and respond within 48 hours.