EverPacket Global Consumer Rights Addendum

Effective date: August 26, 2026

This Addendum preserves mandatory local rights. It is not a substitute for the localized contract, privacy notice, seller disclosure, withdrawal flow, representative, registration, or language required for a particular market. EverPacket must block checkout in a market until its launch checklist is approved.

1. How this Addendum works

This Addendum supplements the EverPacket Terms of Use, Privacy Policy, Refund, Cancellation and Withdrawal Policy, and Consumer Health Data Privacy Notice. If a clause in those documents conflicts with a non-waivable law that protects you, the mandatory law controls and the clause applies only to the maximum lawful extent.

A Payment Merchant’s technical ability to accept a payment does not establish that EverPacket is legally available in every country or region. A Cloudflare-provided country signal may be used as a preliminary market gate, while the Payment Merchant’s final billing-country record controls paid launch eligibility. A verified paid transaction reported with a United States billing country will ordinarily be fulfilled even if the customer later accesses EverPacket from another country. A user must not knowingly misstate country or billing information or bypass a gate; such conduct may be a material breach, but it does not waive non-waivable consumer rights.

The software operator, provider, and licensor is Kimi Chen, a California sole proprietor doing business as EverPacket, at 8843 Villa La Jolla Drive Apt 2, La Jolla, CA 92037, USA. For a transaction processed through Stripe Managed Payments, the Payment Merchant—the legal entity identified by Stripe or Link at checkout and on the receipt—is the merchant of record for that transaction.

2. Common rights that are never excluded

Nothing in the EverPacket documents excludes or limits, where applicable:

• a right to accurate pre-contract information, a clear total price, and a final opportunity to review an order;

• a statutory cooling-off, withdrawal, or cancellation right;

• digital-content or service conformity, satisfactory-quality, fitness-for-purpose, description, security, durability, accessibility, or update obligations;

• a remedy for non-delivery, defect, misdescription, unfair practice, unauthorized payment, or misleading statement;

• privacy, access, correction, deletion, objection, portability, complaint, or breach-notification rights;

• liability that cannot lawfully be excluded, such as certain fraud, intentional misconduct, gross negligence, death, personal injury, or mandatory consumer remedies; or

• the right to use a local court, regulator, ombudsman, or consumer body that mandatory law makes available.

EverPacket does not require pre-dispute arbitration or a class-action waiver. California governing-law and forum clauses apply only where local mandatory law permits.

3. United States

3.1 Federal law

EverPacket’s initial paid launch is limited to transactions for which the Payment Merchant verifies a United States billing country. Public information pages may remain accessible elsewhere, but technical access to the website or a payment method does not mean that paid availability has been approved outside the United States. The unsupported-country experience at initial launch is limited to public information, an unlinked country-interest count, and ordinary outbound social links; it does not operate a non-U.S. email waitlist or create an EverPacket account.

Electronic acceptance and records are intended to comply with the Electronic Signatures in Global and National Commerce Act. The checkout must give the buyer a clear opportunity to review and retain the contract and Payment Merchant receipt.

EverPacket's product, privacy, security, price, local-storage, refund, and “no cloud upload” claims must be accurate under Section 5 of the Federal Trade Commission Act. A privacy or security claim may not be broader than the implemented code and configuration.

The Service is not directed to children under 13 and accounts or purchases require the age of legal majority. Child-directed processing must not be introduced without a Children's Online Privacy Protection Act review.

Transactional account, authentication, purchase, security, legal, and support email is not marketing. At initial launch, EverPacket does not collect non-U.S. email addresses for country-availability or product-news messages. Any later commercial email program must use an appropriate collection notice and consent or other permitted basis, accurate sender and subject information, EverPacket’s valid physical postal address where required, and a simple opt-out mechanism that remains usable and is honored within the applicable deadline. Marketing consent is not a condition of product access or purchase.

3.2 California

California residents receive the disclosures in the Privacy Policy under the California Online Privacy Protection Act. To the extent EverPacket is subject to the California Consumer Privacy Act as amended by the CPRA, California residents have the statutory rights and non-discrimination protections provided by that law.

EverPacket does not currently sell personal information or share it for cross-context behavioral advertising. Optional first-party product analytics, campaign attribution, and text-slot experiment records require the applicable analytics choice and are designed to exclude packet contents, names, contact details, free text, full URLs, DOM capture, and session replay. Launch reporting integrations read aggregate Meta and Google campaign metrics and do not upload EverPacket account email, account identifiers, visitor identifiers, purchase identities, or packet information to those platforms. Global Privacy Control is honored as an overriding instruction to disable optional product and marketing analytics.

California consumer-rights, unfair-competition, false-advertising, and electronic-transaction laws remain available. A liability or warranty limitation applies only to the extent permitted.

3.3 Other U.S. states

Comprehensive privacy, consumer-health-data, auto-renewal, unfair-practice, accessibility, data-breach, and consumer laws vary by state. EverPacket Full is a one-time purchase and must not be marketed as a subscription or automatic renewal. To the extent a state privacy or consumer-health-data law applies, EverPacket will provide required access, correction, deletion, consent withdrawal, opt-out, appeal, sensitive-data, and recognized-signal controls. The Consumer Health Data Privacy Notice describes EverPacket’s local-first health-data practices and the additional rights that may apply.

4. European Union and European Economic Area

4.1 Data protection

Where the GDPR applies, EverPacket must provide an Article 13 or 14 notice, a lawful basis, data-minimization, processor agreements, records of processing, security, rights handling, breach response, and lawful international-transfer mechanisms. Before regularly offering the Service in the EEA, EverPacket must appoint and publish an Article 27 representative unless qualified counsel documents a valid exception.

Packet contents remain local by design, but account, transaction, consent, support, security, and optional product-event information is processed by EverPacket and its providers. The local-first design does not eliminate GDPR duties for that information.

4.2 Distance contracts and digital content

Before an EEA order, the buyer must receive the trader's identity and address, main product characteristics, total price, payment and delivery arrangements, compatibility and functionality, complaint handling, withdrawal information, and other information required by the Consumer Rights Directive and national law.

For digital content supplied during the 14-day withdrawal period, loss of the withdrawal right is valid only if all statutory conditions are met. EverPacket must use a separate unchecked control for the consumer's express request for immediate supply and a separate or legally valid acknowledgment of the effect on withdrawal rights, and must confirm the agreement on a durable medium.

Directive (EU) 2023/2673 requires an online withdrawal function for covered distance contracts from June 19, 2026. The function must be easy to find, continuously available during the relevant period, permit submission and confirmation of the withdrawal, and provide prompt durable acknowledgment. An EEA checkout is a no-go until this control is operational.

4.3 Digital-content conformity

Under Directive (EU) 2019/770 and national implementing law, EverPacket must meet objective and subjective conformity requirements, supply updates - including security updates - for the period reasonably expected, and provide statutory remedies for failure to supply or lack of conformity. A future major-edition label does not avoid a mandatory update or remedy duty.

Disclosed local-only storage, no sync, no EverPacket encryption, browser requirements, file limits, and offline/online dependencies form part of the pre-contract description and must remain accurate.

4.4 Accessibility and fair practices

The European Accessibility Act and national accessibility laws must be assessed before EEA launch. A microenterprise exemption for certain services may apply only after the business documents that every condition is satisfied; it must not be assumed merely because EverPacket is a sole proprietorship.

Dark patterns, hidden material information, pre-checked consent, false scarcity, confusing cancellation, and misleading privacy or security claims are prohibited under unfair-commercial-practice and consumer law.

4.5 Language and national law

Member States impose additional language, trader-registration, tax-record, warranty, complaint, and consumer-authority rules. The EEA must be launched country by country or through counsel-approved clusters, not as one undifferentiated “EU” market.

5. United Kingdom

The UK GDPR and Data Protection Act 2018 govern covered personal-data processing. A U.S. controller offering services to people in the UK must assess the UK representative requirement and publish the representative where required. International transfers require a valid UK mechanism.

The Privacy and Electronic Communications Regulations govern cookies and similar storage. EverPacket's analytics opt-in and GPC/DNT opt-out posture should remain at least as protective as the law requires. Strictly necessary local storage must be clearly explained because deleting it can remove packet contents.

The Consumer Contracts Regulations 2013 govern distance-contract information and cancellation. Immediate supply of digital content during the cancellation period requires the consumer's express consent and acknowledgment. The Consumer Rights Act 2015 provides non-excludable digital-content quality, fitness, description, and remedy rights.

The Digital Markets, Competition and Consumers Act 2024 and related rules prohibit unfair commercial practices. Checkout, price, refund, compatibility, and local-storage claims must be prominent and accurate.

6. Canada

Where PIPEDA applies, EverPacket remains accountable for personal information transferred to service providers, must identify purposes, limit collection, protect information, retain it only as needed, provide access and correction, and designate a privacy contact. Provincial privacy and consumer laws may apply instead of or alongside PIPEDA.

Canada's anti-spam law requires valid consent or another permitted basis, sender identification, an unsubscribe mechanism, and records for commercial electronic messages. Necessary account, authentication, receipt, security, and support messages should remain separated from marketing.

Internet-agreement cancellation and disclosure rules vary by province. A provincial mandatory remedy prevails over the voluntary 14-day policy.

7. Quebec

EverPacket must not launch in Quebec with an English-only product and legal flow.

Before launch, EverPacket must provide the consumer contract and technology or platform information in French in the manner required by the Charter of the French Language. An English standard-form contract may be selected only after the French version has first been provided and the consumer makes the legally effective choice. French must be at least as accessible and prominent as English.

Quebec's private-sector privacy law, as amended by Law 25, requires governance, a privacy officer, privacy-by-default for public technology settings, clear consent where consent is used, incident processes, and a privacy impact assessment before communicating personal information outside Quebec. The transfer must be governed by a written agreement and provide adequate protection.

French checkout, policies, privacy rights, support, cancellation, and receipt communications must be operational before Quebec is enabled.

8. Brazil

Brazilian launch requires Portuguese terms, privacy notice, consumer disclosures, support, cancellation route, and contract confirmation.

The LGPD may apply to processing connected with offering goods or services to people in Brazil. EverPacket must provide a lawful basis, transparent notice, rights channel, security, incident response, records, controller and operator information, and lawful international transfers. ANPD Resolution 19/2024 transfer clauses or another valid mechanism must be incorporated where required.

The Consumer Defense Code and Decree 7,962/2013 require clear supplier identity and address, product characteristics, restrictions, total price, payment and delivery, contract summary, support, and an easy electronic cancellation process. Online consumers generally have seven days to withdraw. For initial launch, EverPacket should honor a timely Brazilian withdrawal even after a paid output unless Brazilian counsel approves the exact exception and flow.

9. Australia

The Australian Consumer Law provides consumer guarantees that cannot be excluded. Digital products and services must meet applicable guarantees, and a consumer may be entitled to repair, replacement, cancellation, refund, or compensation depending on the failure. A “no refunds after output” rule cannot override those guarantees.

The Privacy Act 1988 and Australian Privacy Principles apply if EverPacket is an APP entity, including where an exception or Australian-link rule brings it within scope. A small-business turnover exception must be documented rather than assumed, because exceptions and overseas-business rules may apply.

Prices shown to Australian consumers must be clear, and consumer remedies must not be described in a misleading way.

10. New Zealand

The Consumer Guarantees Act 1993 and Fair Trading Act 1986 provide non-excludable consumer rights and prohibit misleading conduct and unfair standard terms. Digital-product defects, non-delivery, incompatibility contrary to disclosure, and misdescription may require a remedy beyond the voluntary policy.

The Privacy Act 2020 applies to covered overseas organizations carrying on business in New Zealand. It requires privacy principles, access and correction, safeguards, breach notification for qualifying serious harm, and compliant overseas disclosures under Information Privacy Principle 12.

11. Japan

Before targeting consumers in Japan, EverPacket must publish a Japanese seller disclosure under the Specified Commercial Transactions Act, commonly presented as 特定商取引法に基づく表記. The disclosure should identify the seller, responsible person, address, telephone or legally accepted contact details, price and tax, additional costs, payment methods and timing, delivery timing, system requirements or restrictions, and return or cancellation terms.

Required information must appear in the order flow and final confirmation screen. Japanese terms, privacy information under the Act on the Protection of Personal Information, and support should be available. Cross-border disclosures and contractual protections must be reviewed under current Personal Information Protection Commission guidance.

The Consumer Contract Act and prohibitions on misleading or unfair clauses apply. Japan remains gated until the Japanese flow is approved.

12. South Korea

South Korean launch requires Korean-language terms, privacy policy, seller and e-commerce disclosures, withdrawal and digital-content exception controls, complaint handling, and the registrations or local contacts required for the specific sales model.

The Personal Information Protection Act regulates covered processing, notice, rights, security, overseas transfers, and breach response. The Act on Consumer Protection in Electronic Commerce regulates online contracting, records, cancellation, and digital-content exceptions. EverPacket must not rely on a digital-content withdrawal exception without the required information, consent, and consumer opportunity required by Korean law.

13. Taiwan

Taiwan launch requires Traditional Chinese terms, privacy notice, seller information, product restrictions, and cancellation controls.

The Consumer Protection Act generally gives consumers a seven-day right to rescind a distance transaction. An exception for supplied digital content or fully performed online services applies only when the business provides the required prior notice and obtains prior consent. EverPacket must not assume the exception from general-terms acceptance.

The Personal Data Protection Act governs covered account and transaction information. Local packet contents remain on the user's device, but account, purchase, consent, security, and support information still requires a compliant notice and rights process.

14. India

India launch requires review under the Digital Personal Data Protection Act 2023 and the final Digital Personal Data Protection Rules notified in 2025 as their provisions become effective. During the transition, the Information Technology Act and Sensitive Personal Data or Information Rules may continue to apply to covered processing.

EverPacket must provide a clear notice, lawful consent where consent is used, a rights and grievance channel, security and breach controls, processor contracts, and any required Significant Data Fiduciary measures. A local grievance contact and India-specific response process should be published.

The Consumer Protection (E-Commerce) Rules 2020 and dark-pattern guidelines require clear seller, price, return, refund, grievance, and ranking or design information. Drip pricing, confirm shaming, false urgency, subscription traps, and obstruction of cancellation are prohibited. EverPacket is one-time purchase only and must remain clearly presented that way.

15. Singapore

Singapore's Personal Data Protection Act requires accountability, notice, consent or another permitted basis, purpose and collection limits, accuracy, protection, retention limits, transfer protection, access and correction, and assessment and notification of qualifying breaches. EverPacket must designate a data-protection contact before launch.

Consumer transactions are also subject to the Consumer Protection (Fair Trading) Act and other e-commerce requirements. The product description, local-storage limits, price, refund policy, and compatibility must not be unfair or misleading.

16. Hong Kong

Hong Kong's Personal Data (Privacy) Ordinance requires fair and necessary collection, a Personal Information Collection Statement at or before collection, purpose and recipient disclosure, retention limits, security, openness, and access and correction rights. A data user remains responsible for processors through contractual or other means.

Any direct marketing requires the specific information, consent, and opt-out process required by the Ordinance. EverPacket does not currently use account information for direct marketing.

The Trade Descriptions Ordinance and consumer law prohibit misleading product or price claims. A Hong Kong launch requires a locally reviewed collection statement and consumer disclosures.

17. Switzerland

The revised Federal Act on Data Protection applies to covered processing of people in Switzerland and requires transparency, security, rights, breach assessment, and lawful overseas disclosures. A foreign controller must appoint a Swiss representative under Article 14 when all statutory conditions, including regular large-scale high-risk processing, are met. EverPacket must document the assessment and publish the representative if required.

Transfers to the United States require an adequate framework for a certified recipient or another valid safeguard, such as recognized standard clauses and supplementary measures. The vendor manifest must identify the mechanism for each provider.

18. South Africa

The Protection of Personal Information Act applies to covered processing and regulates lawful processing, security, rights, unsolicited electronic communications, operators, information officers, cross-border transfers, and security-compromise notification. The responsible party remains accountable when an operator processes information.

Before South African launch, EverPacket must assess and complete Information Officer registration and any Promotion of Access to Information Act manual duties applicable to the business. Current Information Regulator guidance treats reportable security compromises broadly and requires notice as soon as reasonably practicable.

The Electronic Communications and Transactions Act 25 of 2002 contains supplier-information, electronic-contract, and cooling-off rules, subject to statutory exclusions and amendments. The Consumer Protection Act may also apply. A South African legal review is required before enabling checkout.

19. Mexico

Mexico launch requires a Spanish privacy notice under the current Federal Law on Protection of Personal Data Held by Private Parties, including the controller's identity, purposes, transfer information, rights process, and security commitments.

The Federal Consumer Protection Law, including electronic-transaction provisions, requires clear supplier identity, security and confidentiality, transaction information, and fair online practices. Spanish seller, price, delivery, refund, and complaint information must be available.

20. Other markets

The following markets require a country-specific review before checkout is enabled, even when the Payment Merchant can accept payment:

• Turkey, Israel, the United Arab Emirates, Saudi Arabia, and other Middle East markets with local privacy, consumer, e-commerce, data-residency, representative, or language requirements;

• Indonesia, Malaysia, Thailand, the Philippines, Vietnam, and other Southeast Asian markets with local privacy notices, rights, breach, cross-border, registration, or e-commerce rules;

• Argentina, Chile, Colombia, Peru, Uruguay, and other Latin American markets with Spanish or Portuguese consumer and privacy requirements;

• Norway, Iceland, and Liechtenstein as EEA states, and non-EEA European markets with separate national rules; and

• any jurisdiction that requires a local entity, tax registration not handled by the Payment Merchant, local-language contract, data-localization measure, mandatory warranty, regulator filing, or specific online-dispute route.

EverPacket should publish an approved-market list rather than stating “available worldwide.”

21. Language and conflict

Where a market requires a local-language contract or notice, EverPacket will provide it before collection or purchase. A consumer will not be forced to accept an English standard-form contract when local law requires the local-language version first.

If a translation conflicts with English, the version designated by mandatory local law controls for that market. A translation must be based on the same production version and integrity hash and must be updated with the English source.

22. Complaints and regulators

Contact support@everpacket.com for product, refund, or consumer issues and privacy@everpacket.com for privacy issues. You may also contact a competent consumer, privacy, data-protection, competition, or e-commerce authority.

Nothing requires you to complete an informal support process before making an urgent regulator complaint, exercising a statutory withdrawal right, disputing an unauthorized payment, or seeking mandatory relief.

23. Market availability statement

The approved-market service and country controls are part of the paid-product availability rules. At initial launch, the approved paid market is the United States, determined by the Payment Merchant’s final billing-country record. A preliminary IP-derived country signal may route or block checkout but does not override a verified United States billing country. A verified paid transaction reported with a United States billing country is ordinarily fulfilled, and later access from another country does not by itself revoke the license. If the Payment Merchant’s final record reports a billing country outside an approved market, EverPacket will not activate the paid entitlement and will arrange a prompt full refund after provider reconciliation. Knowingly false country or billing information may lead to investigation, suspension, cancellation, or refund, without limiting a mandatory consumer right.