Stikler, LLC Privacy Statement

Effective Date: 9/1/2026

Introduction

Stikler, LLC (“Company”, “we”, “us”) owns and operates DoDilly®, a cloud platform that helps businesses monitor whether social media content complies with U.S. truth in advertising laws, including the Federal Trade Commission’s Endorsement Guides and the Rule on the Use of Consumer Reviews and Testimonials (the “Platform”).

This Privacy Statement describes how we collect, use, maintain, protect and disclose information through our website at www.dodilly.com, through the Platform application at app.dodilly.com (together, the “Sites”), and in providing the Platform.

It applies to three groups of people, and the parts that apply to you depend on which group you are in:

• Website visitors. People who visit www.dodilly.com.
• Subscribers and their users. Businesses that subscribe to the Platform (“Subscribers” or “Users”) and the individuals they authorize to use it. Platform accounts are provisioned by a Subscriber’s administrator; there is no public sign-up.
• Content creators. Individuals whose public social media content is monitored through the Platform. If you are a creator, the sections most relevant to you are Creators and Monitored Content and Your Privacy Rights.

If you have questions about this Privacy Statement or how we handle information, email privacy@dodilly.com. To make a privacy rights request, email privacy@dodilly.com.

The terms governing a Subscriber’s use of the Platform are at https://dodilly.com/saas-subscription-agreement.

Table of Contents

1. Our Relationship With You
2. Information We Process
3. Creators and Monitored Content
4. How We Use Information
5. How We Disclose Information
6. Security, Storage, Transfers and Retention
7. Cookies and Analytics
8. Artificial Intelligence
9. Children
10. Your Privacy Rights
11. U.S. State Privacy Laws
12. International
13. Changes and Contact

1. Our Relationship With You

Our role under privacy law depends on whose information is involved.

We are a service provider and processor for information in a Subscriber’s Platform account. This includes the identities of creators a Subscriber selects for monitoring, the content collected about them, and the compliance findings generated. The Subscriber decides who is monitored, why, and for how long. The Subscriber is the controller and business for that information. We process it only on the Subscriber’s documented instructions.

We are a controller for our own information. This includes website visitor data, marketing and sales contacts, and Subscriber account and billing records.

If you use the Platform through a company account, that company’s administrator can restrict, suspend or terminate your access, view information associated with your use, and retain or delete information the company stores in the Platform.

2. Information We Process

Information you give us directly

Contact details you submit through www.dodilly.com, information you provide when you use a Platform account, correspondence with us, and anything you choose to send us.

Information we receive from Subscribers

Account setup information, including the identities of the creators the Subscriber wants monitored: names, screen names, social media handles, profile URLs, and any notes or campaign context the Subscriber adds. We also receive contact information for the Subscriber’s own personnel so we can administer the account.

Information we collect about monitored creators

Described in Section 3.

Information collected automatically

When you visit either of the Sites we may collect your IP address, device type, device identifiers, browser type, approximate location at country or city level, referring pages, and how your device interacted with our pages. We use this for analytics and to improve the Sites and the Platform.

Information we do not collect

We do not collect or store Subscribers’ payment card or bank account details. Payment processing is handled by a third-party payment processor identified in Section 5.

3. Creators and Monitored Content

The Platform exists to monitor social media content for advertising disclosure compliance. Disclosure obligations arise only where there is a material connection between an advertiser and the person endorsing it, so the creators monitored through the Platform are people who have an advertising, endorsement, sponsorship, affiliate, ambassador or employment arrangement with the Subscriber, or with an advertiser the Subscriber acts for. They have a relationship with the Subscriber. They do not have a relationship with us, and this section explains what we do with their information and how to reach us about it.

What we collect. Publicly available information about creators a Subscriber has designated: name and screen name, social media handle, profile picture, biography, follower and engagement counts, linked websites, and the public posts, captions, hashtags, tags and disclosures associated with the campaigns or brands the Subscriber is monitoring. We also generate compliance findings, which are our assessments of whether that content appears to carry the disclosures the law requires, whether it follows the Subscriber’s brand guidelines, and whether it is consistent with any exclusivity the Subscriber has agreed with the creator.

How we collect it. We collect publicly available content by automated means. In practice that includes:

• automated collection from public pages on social media platforms, including Instagram, TikTok, X and Facebook;
• third-party search interfaces, including the Google and Brave search APIs;
• automated browser tools that retrieve publicly available web pages; and
• direct platform interfaces where they are available to us.

We collect only content that is publicly visible. We do not log in as any creator, and we do not use any creator’s credentials.

What we do not collect about creators. We do not collect creators’ private messages, direct messages, private or restricted posts, stories limited to selected audiences, or audience analytics, from any source. Creators do not hold Platform accounts and do not communicate with anyone through the Platform.

Why we process it. To provide the monitoring and evidence service the Subscriber has engaged us for, which supports the Subscriber’s compliance with advertising disclosure law and its agreements with its creators.

How you should have heard about this. Our agreements require Subscribers to disclose, in their arrangement with you or in a notice given to you, that your public content may be monitored for advertising disclosure compliance by a service provider acting on their behalf. If you were not told, tell us and we will raise it with the Subscriber.

Who decides. The Subscriber selects the creators and the campaigns. We do not choose who is monitored, and we do not verify the arrangement between a Subscriber and a creator. Under our agreements, Subscribers may designate only individuals with whom they, or the advertiser they act for, have an advertising or endorsement arrangement; must ensure that arrangement or a notice given to the individual permits the monitoring; must comply with applicable law and platform terms; and may not designate anyone under the age of eighteen.

4. How We Use Information

We use information to operate, secure, support and improve the Sites and the Platform; to provide Subscribers with monitoring, alerts, reporting and the compliance evidence record; to set up and administer accounts; to provide customer support and send service and security notices; to communicate about products and offers where permitted; to conduct research and analysis, including combining information into aggregated or de-identified datasets; to detect and prevent fraud and abuse; and to comply with law and enforce our agreements.

We may use aggregated or de-identified information, which no longer identifies any individual, for any lawful purpose, and we will not attempt to re-identify it.

5. How We Disclose Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not disclose personal information to third parties for their own direct marketing purposes.

We do not send creator content to any third-party artificial intelligence provider. Compliance analysis is performed by a model we built and run ourselves, as described in Section 8.

We disclose information as follows:

• Service providers and subprocessors. The providers listed below perform services for us. They act on our instructions and are contractually restricted from using the information for their own purposes. We will update this list when it changes.
  • Vercel Inc. Hosts the Platform application. United States.
  • Supabase Inc. Database, file storage, error logging and account emails. United States.
  • Google. Search interface used for collection, and website analytics. United States.
  • Brave Software. Search interface used for collection. United States.
  • Microsoft. Business email and correspondence. United States.
• To the Subscriber. Monitoring results and compliance findings are delivered to the Subscriber whose account they belong to, and to that Subscriber’s account administrator.
• Within the Platform. Information in a Subscriber’s account may be visible to other authorized users in that account, depending on the settings the Subscriber chooses.
• At your direction. Where you ask us to share.
• Affiliates. Companies under common ownership with us, subject to this Privacy Statement.
• Legal process and safety. To comply with a valid legal request, to establish or defend legal claims, or to protect against harm. Where we are permitted to do so, we will notify the affected individual or Subscriber first.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, in which case the information remains subject to this Privacy Statement until the acquirer updates it.

6. Security, Storage, Transfers and Retention

Security. We maintain administrative, physical and technical safeguards designed to protect information against loss, misuse and unauthorized access or disclosure. No system is perfectly secure, and we cannot guarantee absolute security. Subscribers and their administrators are responsible for managing their own credentials and access controls, including enabling multi-factor authentication where available. That responsibility does not reduce ours.

Storage. The Platform is hosted by Vercel and its data is stored with Supabase, both identified in Section 5. The model described in Section 8 runs on computing equipment owned and controlled by Stikler.

Transfers. Our operations and our service providers are in the United States, and we do not routinely transfer personal information outside it. If that changes we will update this Privacy Statement before doing so. See Section 12.

Retention. We keep information only as long as needed for the purpose it was collected for, and then delete or de-identify it. Our criteria are:

• Website visitor and analytics data. For as long as needed to understand and improve how the Sites are used, and no longer than the retention period configured in our analytics tool.
• Marketing and sales contacts. Until you unsubscribe or ask us to delete, and then only as needed to honor that request.
• Subscriber account and billing records. For the subscription term, and afterwards for as long as needed for tax, audit and legal purposes.
• Creator content and compliance findings in a Subscriber account. We do not retain these after a subscription ends unless the Subscriber instructs otherwise. Absent instruction, we delete them within thirty (30) days of the end of the subscription term. During the term, retention is at the Subscriber’s direction.
• Backups. Deleted on our standard backup rotation.

7. Cookies and Analytics

We use only first-party cookies and similar technologies, and we use Google Analytics to understand how visitors use the Sites. We do not use advertising cookies, remarketing tags, social media trackers or ad-tech pixels, and we do not participate in cross-context behavioral advertising.

You can opt out of Google Analytics using Google’s browser add-on at https://tools.google.com/dlpage/gaoptout.

Global Privacy Control and Do Not Track. Because we do not sell or share personal information, there is no sale or sharing for a Global Privacy Control signal to opt out of. We do not respond to Do Not Track signals, which have no agreed standard.

8. Artificial Intelligence

Compliance analysis in the Platform is performed by a model that we built and that we run ourselves. Creator content is not sent to OpenAI, Anthropic or any other third-party artificial intelligence provider for analysis. The model runs on computing equipment owned and controlled by Stikler.

The model produces suggestions and flags for a person to review. It does not make decisions about any individual, and no legal or similarly significant decision about any person is made by it. A human reviews what it surfaces and decides what to do about it.

We developed the model using publicly available social media content.

9. Children

No one under eighteen. You may not create or use a Platform account if you are under the age of eighteen. We do not knowingly collect personal information directly from anyone under eighteen.

Monitored creators. Subscribers may not designate anyone under the age of eighteen for monitoring. That prohibition is absolute and is a material obligation under our agreements. Subscribers select who is monitored and are in a position to know, because they have contracted with the individual for the advertising activity being monitored.

Prohibited uses. Subscribers may not use the Platform to make or support decisions about a monitored individual’s eligibility for employment, credit, housing, insurance or education.

If you believe we hold information about anyone under eighteen, contact privacy@dodilly.com and we will act on it.

10. Your Privacy Rights

Depending on where you live, you may have the right to know what information we hold about you and where it came from, to get a copy of it, to correct it, to delete it, to limit certain processing, to take it elsewhere in a portable format, to withdraw consent, and not to be discriminated against for exercising any of these rights.

How to make a request. Email privacy@dodilly.com.

How we verify you. We will ask for enough information to confirm you are who you say you are, matched against what we already hold. We do not ask for more than we need. An authorized agent may act for you with written permission or a power of attorney, and we may contact you to confirm.

How long we take. We confirm receipt within ten business days and respond within forty-five days, and we will tell you if we need a further forty-five days.

If you use the Platform through your employer or client. Direct your request to that organization’s account administrator. We will redirect you and notify them.

If you are a creator whose content is monitored. The business monitoring your content is the business you have an advertising or endorsement arrangement with, and it decides what happens to that information. Contact them first. If you are not sure who to contact, or they do not respond, email privacy@dodilly.com with whatever detail you have, such as your handle. We will identify the accounts your information appears in, notify the Subscribers responsible, pass on your request, and support their response.

11. U.S. State Privacy Laws

Several U.S. states have comprehensive consumer privacy laws. Which apply to a given business depends on thresholds in each law, and our obligations differ depending on whether we act as a controller or as a service provider or processor.

For information where we are the service provider or processor, which includes creator content and compliance findings in a Subscriber’s account, we handle it only on the Subscriber’s instructions and assist the Subscriber in responding to rights requests. The Subscriber is the controller.

For information where we are the controller, which includes website, marketing and account records, we honor the rights described in Section 10.

Notice to California residents. We collect the categories of personal information described in Section 2: identifiers, internet and network activity, and, for creators, identifiers, publicly available content and the inferences reflected in compliance findings. We collect them for the business purposes described in Section 4 and disclose them to the recipients described in Section 5.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding twelve months.

We do not use or disclose sensitive personal information for purposes that would require offering a right to limit. The Platform does not collect private messages, communications or precise location.

We do not offer financial incentives in exchange for personal information.

California “Shine the Light.” We do not disclose personal information to third parties for their own direct marketing purposes.

12. International

Our operations are in the United States and the Platform is intended for use by businesses in the United States. If you access the Sites from outside the United States, your information will be processed in the United States.

We do not offer the Platform to Subscribers established in the European Economic Area or the United Kingdom, and we do not monitor creators located there on the basis of our own establishment in those regions.

13. Changes and Contact

We may update this Privacy Statement. When we do we will change the date at the top, and where the change is material we will take additional steps to tell you, such as emailing account holders. Where the law requires your consent to a change, we will obtain it.

Questions, requests or complaints: privacy@dodilly.com, or Stikler, LLC, 715 Mawman Ave., Lake Bluff, IL 60044.