Privacy Policy

Effective as of February 23rd, 2026

This Privacy Policy describes how Shortlist, Inc. and our subsidiaries and affiliates ("Shortlist," "we," "us," or "our") processes personal information that we collect through our digital or online properties or services that link to this Privacy Policy (including as applicable, our website, mobile application, social media pages, marketing activities, and other activities described in this Privacy Policy (collectively, the "Service")). Shortlist is a platform that allows users to discover, rank, and share their opinions on movies, television shows, and other entertainment content.

BY USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY AND AGREE TO THE COLLECTION, USE, SHARING, AND SALE OF YOUR PERSONAL INFORMATION AS DESCRIBED HEREIN. IF YOU DO NOT AGREE, DO NOT USE THE SERVICE.

Index

Personal Information We Collect
How We Use Your Personal Information
How We Share Your Personal Information
Your Choices
US State Privacy Rights (§5A — All States; §5B — California/CCPA)
Other Sites and Services
Security
International Data Transfers
Children
Changes to this Privacy Policy
Dispute Resolution; Binding Arbitration; Class Action Waiver
How to Contact Us

1. Personal Information We Collect

Information You Provide to Us.

Personal information you may provide to us through the Service or otherwise includes:

Contact data, such as your first and last name, email address, and phone number.
Account data, such as your username, password, and account credentials.
Profile data, such as your biographical details, profile photograph, links to your profiles on social networks, accounts you follow on the Service, genre preferences, content ratings and rankings, movies and television shows you have watched or want to watch, your age, labels you have applied to titles, and any other information you add to your account profile.
Communications data based on our exchanges with you, including when you contact us through the Service, social media, or otherwise.
User-generated content data, such as photos, images, videos, comments, questions, messages, reviews, rankings, ratings, chats, likes, and other content or information that you generate, transmit, or otherwise make available on the Service, as well as associated metadata.
Promotion data, including information you share when you enter a competition, promotion, or complete a survey.

Data We Collect Automatically.

Device data, such as your computer or mobile device's operating system, manufacturer and model, browser type, screen resolution, IP address, unique identifiers (including advertising identifiers such as Apple IDFA and Google GAID), language settings, carrier, and network information.
Online activity data, such as pages or screens you viewed, time spent on a page, prior website, navigation paths, access times, duration of access, and email open/click data.
Content consumption data, such as the titles you search for, view, rate, or rank; the order and frequency of your rankings; time spent on title pages; skip and scroll patterns; completion rates; watchlist additions; and all interactions with content-related features of the Service.
Precise geolocation data when you authorize the Service to access your device's location.
Communication interaction data such as your interactions with our email, text, or other communications.
Cross-device data, such as information linking your use of the Service across multiple devices, browsers, or platforms, whether collected directly or through third-party partners.

Derived and Inferred Data.

We may derive or infer information about you based on your use of the Service and the other personal information we collect. This includes inferences about your entertainment preferences, viewing habits, personality traits, lifestyle, interests, tastes, and predicted future behavior (collectively, 'Inferred Data'). Inferred Data is treated as personal information under this Privacy Policy.

Data From Third-Party Sources.

We may combine personal information we receive from you with personal information we obtain from other sources, such as:

Public sources, such as government agencies, public records, and social media platforms.
Private sources, such as data providers, data brokers, and social media platforms.
Third-party data brokers and data aggregators from whom we purchase or license data, including demographic data, interest data, and consumer profile data.
Marketing partners, such as joint marketing partners and event co-sponsors.
Third-party services such as social media services you may link to your account.

Cookies and Similar Technologies.

Some of our automatic data collection is facilitated by cookies, pixel tags, web beacons, software development kits (SDKs), and similar tracking technologies. For more information, see our Cookie Notice.

Data About Others.

We may offer features that help users invite their friends or contacts to use the Service, and we may collect contact details about these invitees so we can deliver their invitations. Please do not refer someone to us or share their contact details with us unless you have their permission to do so.

2. How We Use Your Personal Information

We may use your personal information for the following purposes or as otherwise described at the time of collection:

Service Delivery and Operations.

provide, operate, maintain, and improve the Service and our business;
personalize the Service and remember your selections, preferences, and device history;
establish and maintain your user profile, including your ranked lists of movies and television content;
facilitate social features, including connections with other users, messaging, and shared lists;
enable security features of the Service;
communicate with you about the Service, including announcements, updates, security alerts, and administrative messages;
communicate with you about events, promotions, or contests in which you participate;
understand your needs and interests and personalize your experience; and
provide support and respond to your requests, questions, and feedback.

Research, Development, and Analytics.

We may use your personal information for research and development purposes, including to analyze and improve the Service and our business and to develop new products and services.

We may also compile, aggregate, analyze, package, and license datasets — including datasets that contain de-identified, anonymized, or pseudonymized personal information — to third parties for their own research, commercial, or analytical purposes. This includes the sale or licensing of behavioral datasets, preference profiles, and engagement analytics derived from your use of the Service.

Marketing and Advertising.

Direct marketing. We may send you direct marketing communications personalized based on your profile, preferences, and inferred interests. You may opt-out as described in the Opt-Out section below.
Interest-based advertising. Our third-party advertising partners may use cookies and similar technologies to collect information about your interaction with the Service over time, and use that information to serve targeted ads. We may share information about our users with these companies to facilitate interest-based advertising to those or similar users on other platforms.
Cross-context behavioral advertising. We may use personal information collected across different platforms, services, and contexts — including information obtained from third parties — to deliver advertising that is targeted to your inferred interests, demographic profile, and predicted behavior.
Location-based advertising. We may personalize ads based on your device's location where you have authorized such access.

We may sell, rent, trade, or otherwise commercially transfer your personal information — including contact data, profile data, content consumption data, inferred data, and behavioral data — to third parties for their own commercial purposes, including marketing, advertising, analytics, product development, and other uses. We may also share your personal information with third parties for cross-context behavioral advertising purposes, which constitutes 'sharing' under California law.

California residents have the right to opt out of the sale or sharing of their personal information. See the California Privacy Rights section below for instructions on how to exercise this right. Note that opting out of future sales does not affect personal information already sold or shared.

Consumer Profile Development.

We may combine personal information we collect about you with information obtained from third parties to create individual or aggregated consumer profiles. These profiles may reflect your entertainment preferences, viewing habits, demographic characteristics, inferred interests, and predicted behaviors. We may use these profiles internally to improve the Service and may share or sell these profiles to third parties as described in this Privacy Policy.

Compliance and Protection.

comply with applicable laws, lawful requests, and legal process;
protect our, your, or others' rights, privacy, safety, or property;
audit our internal processes for compliance with legal and contractual requirements;
enforce the terms and conditions governing the Service; and
prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, or illegal activity.

In some cases, we may specifically ask for your consent to collect, use, or share your personal information, such as when required by law.

Retention.

We generally retain personal information to fulfill the purposes for which we collected it, including satisfying legal, accounting, or reporting requirements.

We may also retain personal information for as long as it is commercially useful to Shortlist, including for the purpose of providing data analytics, improving our models, maintaining historical records, and supporting business partnerships, even if the original collection purpose has been fulfilled. We may retain de-identified, aggregated, or anonymized data derived from your personal information indefinitely.

In the event a user deletes their account, we will process that request in accordance with the Your Choices and US State Privacy Rights sections of this Privacy Policy. We will delete or anonymize personal information in our direct possession that is not subject to a lawful retention basis, including but not limited to: data retained for legal compliance or fraud prevention. We are not able to require third parties to whom we have previously transferred or sold personal information to delete that information, and such data is not subject to this deletion commitment.

We may share your personal information with the following parties and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection.

Affiliates. Our corporate parent, subsidiaries, and affiliates, for any purpose consistent with this Privacy Policy.
Service providers. Third parties that provide services on our behalf or help us operate the Service (such as hosting, IT, customer support, email delivery, marketing, consumer research, and analytics).
Data brokers, data marketplaces, and data aggregators. We may sell or license your personal information to data brokers, data marketplaces, and other data aggregators for their own commercial use, including resale to their own clients.
Advertising networks and demand-side platforms. We may share your personal information, including behavioral data, inferred data, and advertising identifiers, with advertising networks, demand-side platforms, data management platforms, and other advertising technology companies for the purpose of delivering targeted advertisements on our Service and on third-party platforms.
Advertising partners. Third-party advertising companies for the interest-based and cross-context behavioral advertising purposes described above.
Third parties designated by you. We may share your personal information with third parties where you have instructed us or provided your consent to do so.
Business and marketing partners. Third parties with whom we co-sponsor events or promotions, with whom we jointly offer products or services, or whose products or services may be of interest to you.
Linked third-party services. If you log into the Service with, or link your account to, a social media or other third-party service, we may share your personal information with that third-party service.
Professional advisors. Lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for compliance and protection purposes.
Business transferees. We may disclose personal information in the context of actual or prospective business transactions, including mergers, acquisitions, public stock offerings, or the sale, transfer, or merger of all or part of our business, assets, or shares.
Other users and the public. Parts of your profile and user-generated content (except private messages) will be visible to other users and the public. This information can be seen, collected, cached, copied, or stored by others, and we are not responsible for any such use.

When we share your personal information with third parties, we do not restrict those third parties' further use, sale, or transfer of your personal information except as required by applicable law. We are not responsible for the privacy practices of third parties with whom we share your personal information.

4. Your Choices

In this section, we describe the rights and choices available to all users. California residents should also see the California Privacy Rights section.

Access or update your information. If you have registered for an account, you may review and update certain account information by logging into your account.
Opt-out of marketing communications. You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. You may continue to receive service-related and non-marketing emails. To opt out of text messages, reply STOP.
Cookies. For information about cookies employed by the Service and how to control them, see our Cookie Notice.
Mobile location data. You can disable our access to your device's precise geolocation in your mobile device settings.
Do Not Track. We currently do not respond to 'Do Not Track' or similar signals.
Delete your account. You can request to delete or deactivate your account through your account settings or by contacting us.

Verification Requirement for Rights Requests.

Before we honor any request to access, correct, delete, or otherwise exercise rights with respect to your personal information, we are required to verify your identity. We will ask you to provide information sufficient to verify that you are the person about whom we hold personal information. We may require you to provide two or more pieces of identifying information and, in some cases, a signed declaration under penalty of perjury confirming your identity. We may deny a request if we cannot verify your identity to a reasonable degree of certainty.

Response Timeframe.

We will respond to verifiable rights requests within the timeframes required by applicable law. For California residents, we will respond within 45 days of receiving a verifiable consumer request, with the possibility of a 45-day extension where reasonably necessary. We will inform you of any extension within the initial response period.

Excessive or Repetitive Requests.

If a request is manifestly unfounded, excessive, or repetitive — including requests that are submitted more than twice within any 12-month period — we may either charge a reasonable fee to cover administrative costs or refuse to act on the request. We will notify you if we determine that a fee applies or that we are declining to act, and provide our basis for that determination.

Declining to Provide Information.

We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.

5. US State Privacy Rights

How to Submit a State Privacy Rights Request.

To exercise any of the rights described above, please contact us at: admin@blrbdigital.com or through the Privacy Request link on our website at shortlist.watch. We will verify your identity before processing your request as described in the Verification section above. We will respond within the timeframe required by your state of residence. Where your state law does not specify a timeframe, we will respond within 45 days of receiving a verifiable request, with the possibility of a 45-day extension where reasonably necessary.

Appeals.

If we decline to take action on your rights request, you may appeal our decision by contacting us at admin@blrbdigital.com within 30 days of receiving our response. We will respond to your appeal within the timeframe required by your state of residence. If your appeal is denied, you may have the right to contact your state attorney general or applicable data protection authority. We will provide you with the relevant contact information at the time of our appeal response.

B. California-Specific Rights (CCPA/CPRA)

This subsection applies specifically to California residents and supplements Section 5A above. California law imposes additional requirements not shared by other state privacy laws.

Categories of Personal Information Collected, Sold, and Shared.

Over the next 12 months, we may collect or sell or share the following categories of personal information as defined under the CCPA: Identifiers; Customer records; Protected classification characteristics; Commercial information; Internet or other electronic network activity information; Geolocation data; Inferences drawn from personal information; and Sensitive personal information (where applicable). We may collect personal information from the following categories of sources: directly from you, automatically through your use of the Service, from third-party data brokers, and from our business and advertising partners. Over the next 12 months, we may sell or share all categories listed above.

California residents have the right to opt out of the sale of their personal information and the sharing of their personal information for cross-context behavioral advertising. To exercise this right, click the 'Do Not Sell or Share My Personal Information' link on our website shortlist.watch, submit a request to admin@blrbdigital.com, or use a recognized universal opt-out mechanism such as the Global Privacy Control where supported. This opt-out applies only to future sales and sharing and does not apply to personal information already sold or shared prior to our receipt of your opt-out request.

Right to Limit Use of Sensitive Personal Information.

To the extent we collect sensitive personal information as defined by CCPA (such as precise geolocation, account credentials, or other sensitive categories), California residents may have the right to direct us to limit our use of that information to purposes authorized by law. To exercise this right, contact us at admin@blrbdigital.com.

California-Specific Response Timeframe.

For California residents, we will respond to verifiable consumer requests within 45 days of receipt, with the possibility of a 45-day extension where reasonably necessary. We will inform you of any extension within the initial 45-day period.

Shine the Light.

California Civil Code Section 1798.83 ('Shine the Light' law) permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, contact us at admin@blrbdigital.com.

6. Other Sites and Services

The Service may contain links to websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party websites or services, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites and services you use.

7. Security

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

YOU USE THE SERVICE AND PROVIDE YOUR PERSONAL INFORMATION AT YOUR OWN RISK. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, SHORTLIST SHALL NOT BE LIABLE FOR ANY UNAUTHORIZED ACCESS TO, OR ALTERATION, THEFT, LOSS, OR DESTRUCTION OF, YOUR PERSONAL INFORMATION.

8. International Data Transfers

We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country. Users in Europe should read the Notice to European Users below.

9. Children

The Service is not intended for use by anyone under 13 years of age. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that we have collected personal information from a child under 13 without required parental consent, we will comply with applicable legal requirements to delete the information.

10. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time.

If we make material changes, we will notify you by updating the effective date of this Privacy Policy. We may, but are not required to, provide additional notice for material changes (such as an in-app notice or email). Your continued use of the Service after the effective date of any modified Privacy Policy constitutes your acceptance of the modified terms. If you do not agree to any modification, your sole remedy is to cease using the Service and request deletion of your account.

11. Dispute Resolution; Binding Arbitration; Class Action Waiver

PLEASE READ THIS SECTION CAREFULLY. IT AFFECTS YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE A LAWSUIT IN COURT AND YOUR RIGHT TO A JURY TRIAL.

Informal Resolution.

Before initiating any legal proceeding, you agree to contact us at admin@blrbdigital.com and describe the dispute in reasonable detail. We will attempt to resolve the dispute informally within 30 days of receipt. If we are unable to resolve the dispute informally, either party may proceed to arbitration as described below.

Binding Arbitration.

Except as set forth below, all disputes, claims, or controversies arising out of or relating to this Privacy Policy, the Service, or your personal information (collectively, 'Disputes') shall be resolved by binding arbitration administered by JAMS (jamsadr.com) under its Streamlined Arbitration Rules and Procedures, as modified by this section. The arbitrator shall have exclusive authority to resolve all Disputes, including any claim that all or any part of this arbitration agreement is void or voidable. The arbitration shall be conducted in English, in Delaware, unless the parties agree otherwise. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. The Federal Arbitration Act governs the interpretation and enforcement of this section.

Class Action Waiver.

YOU AND SHORTLIST EACH AGREE THAT ANY DISPUTE RESOLUTION PROCEEDINGS WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION. If for any reason a Dispute proceeds in court rather than through arbitration, you and Shortlist each waive any right to a jury trial and agree that such proceedings shall be brought exclusively in the state or federal courts located in Delaware, and you consent to personal jurisdiction in those courts.

Exceptions.

Notwithstanding the foregoing, either party may bring an individual action in small claims court, and either party may seek injunctive or other equitable relief in court to protect intellectual property rights or to prevent immediate, irreparable harm.

Opt-Out.

You may opt out of the arbitration agreement by notifying us in writing within 30 days of first using the Service. Opting out of the arbitration agreement does not affect any other provisions of this Privacy Policy.

Statute of Limitations.

Any Dispute must be filed within one (1) year after the date on which the party asserting the claim first knew or reasonably should have known of the act, omission, or default giving rise to the claim. After that period, any Dispute is permanently barred.

Governing Law.

This Privacy Policy and any Disputes shall be governed by the laws of the State of Delaware, without regard to its conflict-of-law provisions, except that the Federal Arbitration Act shall govern the arbitration agreement.

12. How to Contact Us

Email: admin@blrbdigital.com
Website: shortlist.watch