State Law Privacy Rights Supplement

ALL THE SMOKE PRODUCTIONS
STATE LAW PRIVACY RIGHTS SUPPLEMENT

Effective Date: October 1, 2026

This Supplement describes the privacy rights available under state law and how the Company honors them. Defined terms have the meanings given in our Privacy Policy.

1. Rights Available To Everyone

We extend the following rights to every United States resident, whatever state you live in and whether or not your state has a privacy law:

Confirm whether we process information about you, and access it.
Correct inaccurate information we hold about you.
Delete information we have collected from you, subject to the exceptions described below.
Receive a portable copy of the information you provided to us.
Opt out of the sale and sharing of your information and of targeted advertising.
Be free from retaliation for exercising any of these rights. We will not deny you content, merchandise or service, charge you a different price or give you a lower level of service because you exercised a privacy right.

Submit any of these through Your Privacy Choices, by email to info@allthesmokeproductions.com, or by calling 877-642-2877.

2. State-By-State Detail

Access, correct, delete, portability
How we handle it: Extended to all U.S. residents.
Notes: No residency verification required.

Opt out of sale, sharing and targeted advertising
How we handle it: Extended to all U.S. residents, honored for the browser and, where you are signed in, for the account.
Notes: No verification required.

Right to know a twelve (12) month lookback
How we handle it: California. We answer back to January 1, 2022 where you ask us to.
Notes: CCPA regulations effective January 1, 2026.

Limit the use of sensitive personal information
How we handle it: Not offered because we do not use sensitive personal information to infer characteristics.
Notes: If that changes, this row and the Notice change with it.

Appeal of a denied request
How we handle it: Extended to all U.S. residents.
Notes: Virginia, Colorado, Connecticut, Texas and others require it. We give it to everyone.

Universal opt-out signals
How we handle it: Global Privacy Control honored automatically.
Notes: Required in California, Colorado, Connecticut, Texas, Montana and a growing list.

Minors
How we handle it: We do not knowingly collect from children under thirteen (13) and do not knowingly sell or share the information of anyone under sixteen (16).
Notes: See Section 10 of the Privacy Policy.

Consumer health data
How we handle it: We do not collect consumer health data.
Notes: Washington, Nevada and Maryland. See Section 3.

Biometric identifiers
How we handle it: We do not collect biometric identifiers or biometric information.
Notes: Illinois BIPA, Texas CUBI, Washington. See Section 3A.

3. Sensitive Data

We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose it for purposes other than those permitted by law. We do not collect consumer health data as the Washington My Health My Data Act, Nevada Senate Bill 370 or the Maryland Online Data Privacy Act define that term.

We do not ask about, and we ask that you do not send us, information about your health, your finances, your immigration status, your religion, your political views, your sexual orientation, your union membership, your precise location or your government identification numbers.

Where you send us that information anyway in a submission, we use it only to respond to you or as part of the content you asked us to consider, and we do not add it to any advertising audience.

3A. Biometric Information

We do not collect biometric identifiers or biometric information. We do not use facial recognition, voiceprint matching or any comparable technology, and we do not license any such technology from a third party. Video and audio you send us is content, and we do not derive biometric templates from it.

4. Profiling And Automated Decisions

We do not use automated decision-making technology to make decisions that produce legal or similarly significant effects about you. We use audience segments for advertising, which is not a decision of that kind.

If that changes, we will update this Supplement, provide notice before the technology is used and give you the ability to opt out and to appeal the outcome.

5. Universal Opt-Out Mechanisms

We honor the Global Privacy Control from every visitor, regardless of state. When we receive the signal we treat it as a valid opt-out of the sale and sharing of information and of targeted advertising, we apply it to the browser transmitting it, we apply it to your account where you are signed in, and we return a confirmation that the request has been processed.

We do not require you to verify your identity or to create an account first.

6. Appeals

If we decline to act on your request, you may appeal within a reasonable time by emailing info@allthesmokeproductions.com with “Privacy Appeal” in the subject line, or by replying to our response.

We will respond in writing within forty-five (45) days and, where we deny the appeal, we will tell you how to contact your state Attorney General. California residents may also complain to the California Privacy Protection Agency at cppa.ca.gov.