Privacy Policy

YOKE Global Inc. ("YOKE," "we," "us," or "our"), together with its subsidiaries and affiliates, including NIL Club LLC, respects your privacy and is committed to protecting it through our compliance with this privacy policy (the "Policy").

This Policy describes the personal information we may collect from you or that you may provide when you visit athletemerch.com (the "Site"), use the Athlete Merch mobile application (the “App”), make a purchase through the Site, receive a text message or email from an athlete who invited you through the NIL Club mobile application (the "NIL Club App"), or otherwise contact or interact with us offline (collectively, the "Services"), and our practices for collecting, using, maintaining, protecting, and disclosing that information. References in this Policy to the Site include the App, where applicable. In this Policy, "you" refers to any individual about whom we collect personal information.

As used in this Policy, "personal information" refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, and includes "personal data" or similar terms used in applicable law.

If you do not agree with this Policy, your sole choice is not to use the Services. We may revise this Policy from time to time; see Section XIII for our process for changes.

This Policy addresses the Services offered at athletemerch.com. It is intended to operate alongside the privacy policy published at nilclub.com/privacy-policy, which addresses the NIL Club App and the broader YOKE platform. If you arrived at the Site through an invitation from the NIL Club App, both policies may apply to you.

We collect the categories of personal information identified below and disclose these categories to service providers for business purposes such as processing orders, fulfilling merchandise, operating the Site, and facilitating our Services. We do not "sell" or "share" your personal information, and we do not use it for "targeted advertising" or "cross-context behavioral advertising," within the meaning of applicable state privacy laws. We use third-party analytics and session-replay technologies on the Site for our own internal analytics, product-improvement, and fraud-prevention purposes; the specific providers are identified by name in Section VIII.

•Identifiers, including name, postal address, email address, phone number, and online identifiers such as internet protocol ("IP") addresses and device identifiers.

•Characteristics of protected classifications under California or Federal law, including gender and age (where voluntarily provided).

•Commercial information, including records of products and services purchased or considered, cart contents, order history, returns, and purchasing tendencies.

•Internet and electronic network activity, such as browsing history on the Site, referring and exit pages, device characteristics, language preferences, clickstream data, dates and times of visits, and — where applicable — recordings of your interactions with pages on the Site (such as mouse movements, scrolling, and clicks) captured by session-replay tools for diagnostic and improvement purposes.

•Geolocation information, limited to approximate location derived from IP address, postal address, or shipping address.

•Inferences drawn from the above to create a profile reflecting your merchandise preferences. We do not use inferences to make decisions with legal or similarly significant effects concerning you.

•Audio, visual, or photo content that you voluntarily submit to us, such as photographs you submit for your athlete profile or store, or included with a return or customer support request.

•User-generated content, such as product reviews, feedback responses, and communications with customer support.

•Professional or educational information that you voluntarily provide, for example if you choose to share a school affiliation or interest.

We process personal information for the following purposes:

•To provide and operate the Services, including to fulfill orders, process payments, arrange shipping, process returns, and provide customer support.

•To enable athletes to communicate with supporters they have invited through the NIL Club App or the App, as described in Section II(b), about the athletes' own offerings.

•To send transactional communications such as order confirmations, shipping updates, and receipts.

•To administer athlete accounts, stores, and any points, rewards, or referral programs.

•To send marketing and promotional communications where permitted by law.

•To operate, secure, and improve the Services, including by using analytics and to assess and prevent fraud.

•To comply with legal obligations and enforce our agreements.

Payment card information is handled directly by our payment processors and is not retained on our servers.

We retain personal information for as long as reasonably necessary to provide the Services, to comply with our legal and tax obligations, to resolve disputes, to enforce our agreements, and to maintain records of consent and opt-out. Marketing preferences and opt-out records are retained for as long as needed to honor your choice.

We collect personal information:

•When you provide it to us;

•When an athlete provides it through the NIL Club App or the App (see II(b));

•Automatically as you interact with the Site; and

•From service providers and other sources.

You may provide personal information when you sign up to receive email or text messages, create an account, create an athlete profile or submit information to set up a merchandise store, place an order, submit a return, subscribe to updates, respond to feedback requests, or contact customer support. This typically includes your name, shipping and billing address, email, phone number, and payment information (which is processed by our payment providers and not retained by us). Content you submit for display on your store (such as your profile and photographs) is visible to the public, and we cannot control how visitors use it.

To summarize: If an athlete invited you through the NIL Club App or the App, your contact information is in our systems so that the athlete can communicate with you about their own offerings, which may include a merchandise store. Your contact information is used only for communications initiated by the athlete who invited you, is not shared with other athletes for their own communications, and you can opt out at any time (see Section V).

athletemerch.com stores are operated by individual athletes using tools provided by YOKE. Athletes invite contacts — typically friends, family, and supporters — through the NIL Club App or the App, consistent with the applicable app's terms of use and privacy policy. When an athlete launches a merchandise store, the athlete may initiate communications to those contacts.

Our role in the flow is to provide the platform, the vendor relationships, and compliance infrastructure. We apply delivery screens to exclude numbers that have opted out or that must not receive communications under applicable law. Athletes do not receive exportable contact lists or raw phone numbers from us; communications are sent through our infrastructure.

A given athlete's contacts are used only for that athlete's own offerings — for example, the athlete's NIL Club membership, the athlete's merchandise store, or the athlete's brand deals. Phone numbers provided by one athlete are not used on behalf of a different athlete.

If you believe your contact information was provided to us in error, or if you wish to have your information removed from our systems, please contact us at privacy@athletemerch.com.

Contacts Data. When you sign up for or use the App as an athlete, you may choose to give us access to your device's address book (“Contacts”) to invite supporters. We use your Contacts to help you send invitations, and we may assist you by sending invitations on your behalf; you also have the opportunity to send invitations yourself. Invitations may include your name. When you provide Contacts, we may combine that information with other information we have about the people in it. We will request your consent to access your Contacts where required by law. You may withdraw your consent, or request deletion of your Contacts data, at any time by contacting privacy@athletemerch.com; withdrawing consent stops our use of your Contacts going forward but does not undo processing that lawfully occurred before you withdrew. Text-messaging originator opt-in data and consent records are never shared with third parties, as described in Section III.

As you interact with the Site, we may collect information about your device, browser, internet connection, and patterns of use, including IP address, operating system, browser type, device characteristics, referring and exit pages, clickstream data, and the pages and products you view. This information helps us operate and improve the Services, measure the performance of campaigns, and prevent fraud. The technologies we use may include cookies, web beacons, pixel tags, software development kits, and session-replay tools. The specific analytics and session-replay providers we use — and the cookies they set — are identified by name in Section VIII.

We may receive information about you from:

•Our service providers, including commerce, payment, fulfillment, shipping, SMS, email, analytics, fraud prevention, and customer support providers, in connection with their services to us.

•Athletes using the NIL Club App or the App, through the invite flow described in II(b). This is the source of contact information for most supporters who receive messages from an athlete. We do not purchase personal information from third-party data brokers.

•Social media services, if you choose to connect your account to, or sign in through, a social media or other third-party service. With your permission, we may receive information from that service, such as your name, username, profile information, and contact details, in accordance with the authorization procedures of that service.

We may combine information received from these sources with information we already have about you.

We may disclose personal information:

•Within our company and with our affiliates, including YOKE Global Inc. and NIL Club LLC.

•With service providers that perform services on our behalf — for example, commerce platforms, payment processors, fulfillment and shipping providers, print-on-demand manufacturers, SMS and email providers, marketing automation platforms, analytics providers, compliance and do-not-call scrubbing providers, fraud prevention providers, customer support platforms, and cloud infrastructure providers. Our agreements with these providers restrict their use of personal information to the purposes for which we engaged them.

•With analytics and session-replay providers, to measure how the Site performs and is used so we can operate, secure, and improve it. These providers act as our service providers/processors and are contractually restricted from using the data for their own purposes. We do not disclose personal information to advertising networks to build cross-site advertising profiles or to serve you targeted advertisements.

•With the athlete who invited you, but only to the limited extent necessary to enable communications the athlete initiates with you regarding the athlete's own offerings. Athletes do not receive raw contact lists or exportable phone numbers from us.

•With professional advisors, such as legal advisors, accountants, and auditors.

•With your consent or at your direction, with other parties you designate.

•To comply with law, including in response to subpoenas, court orders, or legal process, or to respond to regulatory or law-enforcement requests.

•To enforce our agreements or protect our rights, property, or safety, or the rights, property, or safety of our users or others, including for fraud and abuse prevention.

•In connection with a corporate transaction, such as a merger, acquisition, financing, or sale of assets.

WE DO NOT SELL, RENT, LOAN, TRADE, LEASE, OR OTHERWISE TRANSFER FOR PROFIT ANY PHONE NUMBERS OR MOBILE OPT-IN DATA COLLECTED IN CONNECTION WITH OUR SMS PROGRAM TO ANY THIRD PARTY. Mobile opt-in data and consent records are not shared with third parties or affiliates for their own marketing purposes.

We use analytics providers to understand how visitors find and use the Site and to measure the performance of our email and SMS marketing. This analysis is performed for our own internal purposes using the providers identified in Section VIII, which act as our service providers/processors.

We do not engage in "targeted advertising" or "cross-context behavioral advertising," and we do not "sell" or "share" your personal information with advertising networks, as those terms are defined under applicable state privacy laws. We do not place Meta/Facebook, TikTok, or other advertising-network tracking pixels on the Site. If this changes in the future, we will update this Policy and provide any opt-out mechanism required by law before doing so.

To summarize: Athletes use our platform to send messages to contacts they have invited through the NIL Club App. You can stop receiving messages about merchandise at any time by replying SKIP, or stop all future messages to your phone number at any time by replying STOP.

Athletes send messages to their contacts through our platform. We provide the technology, the vendor relationships, and compliance screens that support delivery. We apply delivery screens to exclude numbers that have opted out or that must not be contacted under applicable law.

Messages you receive through our platform relate only to the offerings of the athlete who invited you — for example, the athlete's merchandise store, NIL Club membership, or brand deals. Phone numbers provided by one athlete are not used on behalf of any other athlete.

Message frequency varies. Message and data rates may apply. You should check the rates of your mobile carrier. You acknowledge that text messages are distributed via third-party mobile network providers and, therefore, we cannot control certain factors relating to message delivery, including delays, failures, out-of-order arrival, or duplicate delivery.

You have two opt-out keywords available to you at any time:

•Reply "SKIP" to stop receiving merchandise-related messages from the athlete who is messaging you. You will stop receiving text messages about that athlete's merchandise store.

•Reply "STOP" to stop all future text messages we send to your phone number, from any athlete using our Services. Replying with END, CANCEL, UNSUBSCRIBE, or QUIT will also be treated as a "STOP" request.

For help, reply HELP to any message. You can also contact us at privacy@athletemerch.com to request opt-out or to report a delivery issue. Opt-out requests are processed promptly; you may receive one final confirmation message after replying.

We do not share phone numbers or mobile opt-in data with third parties or affiliates for their own marketing purposes. Phone numbers and related information are shared with our service providers solely for the purposes described in this Policy.

Athletes using our communications features are required, under their agreements with us, to comply with all applicable laws, including the Telephone Consumer Protection Act (TCPA), the Telemarketing Sales Rule, the CAN-SPAM Act, and applicable state telemarketing laws. General information on compliant messaging is available at https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts.

If you use the App, we may send you push notifications, such as updates about your store or rewards. You can disable push notifications at any time in your device settings.

You may opt out of marketing communications at any time:

•For email, click the unsubscribe link in any marketing email.

•For text messages, reply "SKIP" or "STOP" as described in Section V, or contact us at privacy@athletemerch.com.

Even after you opt out of marketing, we may still send you non-marketing communications such as order confirmations, shipping updates, receipts, and responses to your inquiries.

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or any other state with a comprehensive consumer privacy law have certain rights relating to their personal information, which may include:

To opt out of any "sale" or "sharing" of your personal information, you may use our "Do Not Sell or Share My Personal Information" page at athletemerch.com/do-not-sell at any time. You may also exercise the other rights below by contacting us as described in this Section.

•Right to know / access / portability. The right to request what personal information we have collected about you and to receive it in a portable format.

•Right to delete. The right to request deletion of personal information, subject to exceptions (for example, where we need the information to complete a transaction, comply with a legal obligation, or defend legal claims).

•Right to correct. The right to correct inaccurate personal information, subject to verification.

•Right to opt out of sale or sharing. The right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising purposes. As noted, we do not sell personal information. We also do not "share" personal information for cross-context behavioral advertising. Although we do not currently sell or share your personal information as those terms are defined under applicable law, you may submit a request to opt out at any time through our "Do Not Sell or Share My Personal Information" page at athletemerch.com/do-not-sell, by enabling a recognized opt-out preference signal such as the Global Privacy Control, or by emailing privacy@athletemerch.com. We honor these requests and preference signals regardless.

•Right to opt out of targeted advertising. The right to opt out of the use of your personal information for the purpose of delivering advertisements based on your activity over time and across nonaffiliated websites or applications. We do not currently engage in targeted advertising.

•Right to opt out of profiling. The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you — for example, fraud-related decisions regarding your orders. To exercise this right, contact us at privacy@athletemerch.com.

•Right to limit use of sensitive personal information. We do not currently use sensitive personal information to infer characteristics about you.

•Right to non-discrimination. We will not deny Services, charge a different price, or provide a different level of Services because you exercised your privacy rights.

Residents of certain states, including Minnesota, may have the right to request a list of the specific third parties to whom we have disclosed personal information. Contact us at privacy@athletemerch.com to submit such a request.

To exercise any of the rights above, contact us at privacy@athletemerch.com with the subject line "Privacy Rights Request" and include enough information to allow us to verify your identity.

Global Privacy Control. You can signal your choice to opt out of sale, sharing, targeted advertising, and profiling by enabling a recognized opt-out preference signal, such as the Global Privacy Control ("GPC"), in your browser or browser extension. When we detect a valid GPC signal, we will treat it as a request to opt out of sale, sharing, and targeted advertising, to the extent applicable under the laws of your state. Because GPC is a browser-level signal, it may not be linkable to a specific account; you may need to enable it in each browser or device you use. We will honor a GPC signal without requiring additional authorized-agent documentation.

Authorized agents. You may designate an authorized agent to exercise your privacy rights on your behalf. We may require written proof of the agent's authorization and may verify your identity directly. If the request is made using a recognized opt-out preference signal such as GPC, no authorized-agent documentation is required.

Verification. We will only complete your request after your identity has been verified. We may ask for additional information to match your request to the personal information we maintain. Where permitted by law, we may decline a request if we cannot verify your identity.

Response timeline. We will confirm receipt of your request within ten (10) business days and respond to verifiable requests within the period required by applicable law, generally within forty-five (45) days. We may extend the response period by an additional forty-five (45) days when reasonably necessary, and will notify you of any extension.

Appeals. If we decline to act on a request, you may appeal by emailing us at privacy@athletemerch.com with the subject line "Privacy Rights Appeal" and your state of residence. We will respond to your appeal in accordance with applicable law. If your appeal is denied, you may contact your state attorney general.

California residents may request information regarding our disclosure of personal information to third parties for those third parties' direct marketing purposes (Cal. Civ. Code § 1798.83). We do not currently disclose personal information to third parties for their direct marketing purposes. To make a request, contact us at privacy@athletemerch.com.

The Site may offer social sharing features (for example, buttons to share a product to a social network). Using those features may share information with the entity that provides the feature, subject to its own privacy policy.

To request access, correction, or deletion of your personal information, contact us at privacy@athletemerch.com.

This section applies to you in addition to the other sections of this Policy if you are located in the United Kingdom, the European Economic Area, or another jurisdiction outside the United States with comprehensive data protection law.

We process personal information on the following legal bases:

•Performance of a contract — for example, to process and fulfill your orders and provide customer support.

•Legitimate interests — to operate, secure, and improve the Services, measure marketing performance, prevent fraud, and comply with legal obligations, except where overridden by your rights.

•Consent — where required by law. You may withdraw consent at any time; withdrawal does not affect processing before the withdrawal.

•Legal obligation — to comply with tax, accounting, and consumer protection laws.

We operate in the United States. Your personal information is stored and processed on servers in the United States. When we transfer personal information out of the UK, the EEA, or other jurisdictions with similar laws, we rely on appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission (and, where applicable, the UK International Data Transfer Agreement or Addendum). A copy of the Standard Contractual Clauses is available on request from privacy@athletemerch.com.

Subject to applicable law, you have the right to:

•Access your personal information;

•Correct inaccurate personal information;

•Request deletion of your personal information;

•Restrict processing;

•Object to processing, including for direct marketing;

•Data portability;

•Withdraw consent where processing is based on consent; and

•Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at privacy@athletemerch.com.

We do not use solely automated decision-making, including profiling, to make decisions about you that produce legal or similarly significant effects.

YOKE has not appointed a Data Protection Officer because it does not meet the threshold for mandatory appointment under Article 37 of the GDPR. For data protection inquiries, please contact privacy@athletemerch.com.

The Site uses cookies, web beacons, pixel tags, and similar technologies for several purposes:

•Strictly necessary technologies required for the Site to function (such as maintaining your shopping cart and authentication);

•Performance and analytics technologies that help us understand use of the Site;

•Functional technologies that remember your preferences;

•Session-replay and error-monitoring technologies that help us diagnose problems and improve the Site. We do not use advertising or cross-site tracking cookies (such as a Meta/Facebook Pixel, TikTok pixel, or ad-network retargeting tags) on the Site.

We use the following third-party service providers, which collect information through cookies, software development kits, and similar technologies when you use the Site. With the exception of Shopify's checkout pages, these technologies generally operate as first-party cookies or browser storage set on the athletemerch.com domain; the resulting data is shared only with the applicable provider acting as our service provider/processor, and is not used to build cross-site advertising profiles or to serve you targeted advertisements:

Session replay. Three of the providers above — Mixpanel, PostHog, and Smartlook — also record "session replays," which capture your interactions with Site pages, such as mouse movements, scrolling, clicks, and the pages and products you view. We use session replays only to diagnose problems and improve the Site, and not to sell, share, or serve advertising. Payment card information is entered and submitted on our payment processor's (Shopify's) hosted checkout pages, which are not captured by our session-replay tools.

First-party cookies we set. In addition to the providers above, the Site sets the following first-party cookies of our own:

•am_shortlink — remembers the athlete shortlink or referral that brought you to the Site so the correct athlete is credited for your visit (expires after approximately 30 days); and

•athletemerch_checkout — temporarily holds your checkout details (such as the selected athlete and your cart) while you are redirected to checkout (expires after approximately 30 minutes).

You can manage cookies through your browser settings, mobile device settings, and opt-out tools such as the Digital Advertising Alliance at http://optout.aboutads.info/ and the Network Advertising Initiative at https://optout.networkadvertising.org/. You can also use the provider-specific opt-out links in the table above. You can also enable the Global Privacy Control signal in your browser as described in Section VI.

We do not respond to browser-based "Do Not Track" signals, except that we do honor the Global Privacy Control signal.

The Services may contain links to third-party websites or applications. We are not responsible for the privacy practices or content of third-party sites, which are governed by their own privacy policies.

We use reasonable administrative, technical, and physical safeguards to protect personal information from unauthorized access, use, alteration, or disclosure. Payment card information is handled by PCI-DSS-compliant payment processors. Please notify us at privacy@athletemerch.com if you believe your account has been compromised.

No security system is perfect. The transmission of information over the internet is not completely secure and we cannot guarantee the security of personal information transmitted to the Site. We are not responsible for the circumvention of security measures by third parties.

Our Services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe that a child under 13 has provided us with personal information, please contact us at privacy@athletemerch.com. California residents under 18 who use the Services may request removal of content they have posted by contacting us at the same address.

Text messages and emails you receive through our Services will always offer an opt-out (see Section V). If you receive a message that appears to be from an athlete or from us and you are not sure whether it is authentic, do not click any links. Instead, contact us at privacy@athletemerch.com to verify. You can also report suspected phishing to the Federal Trade Commission at https://reportfraud.ftc.gov/.

We may update this Policy from time to time to reflect changes to our practices or applicable law. When we do, we will post the updated Policy on the Site and update the "UPDATED DATE" at the top. If a change is material, we will provide appropriate notice — which may include a banner on the Site, an email, or a notation next to the Policy link on our footer. Your continued use of the Services following an update means you accept the updated Policy.

For questions about this Policy, to exercise your privacy rights, or to make a complaint:

Email: privacy@athletemerch.com

Mail:

YOKE Global Inc. Attn: Privacy Compliance Officer 3405 Piedmont Rd STE #225 Atlanta, GA 30305 United States

© 2026 YOKE Global Inc. All rights reserved.