Whatnot Privacy Policy

This document is Whatnot's Privacy Policy, governing the collection, use, storage, and disclosure of personal information submitted by users of the Whatnot livestream shopping platform, with stated legal bases including consent, contractual necessity, and legitimate interests depending on jurisdiction. The policy states that Whatnot collects identifiers (name, email, phone number, government ID for seller verification), financial information (payment card details, bank account information), device and usage data (IP address, device identifiers, browsing and purchase history, interaction data), location data, and user-generated content including audio and video from live streams. The policy authorizes sharing personal data with advertising partners, analytics providers, payment processors, shipping and fulfillment partners, and third-party marketing platforms, and discloses that certain data transfers may constitute a 'sale' or 'sharing' of personal information under California law, with opt-out rights available; the policy also asserts the right to use livestream content and transaction data for platform improvement and personalized advertising. The policy engages GDPR and UK GDPR for European and UK users, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents, and COPPA for users under 13; Whatnot states the platform is not directed to children under 13 and does not knowingly collect their data. Material compliance considerations include the adequacy of consent mechanisms for EU/UK data transfers to the US, the completeness of seller identity verification data handling disclosures, and the scope of behavioral advertising data sharing relative to CCPA opt-out obligations.