Washington Consumer Health Data Privacy Policy

Effective date: October 10, 2026

This policy applies to Washington residents, and to anyone whose consumer health data is collected in Washington, under Washington's My Health My Data Act. The only consumer health data ToolBNB handles is biometric data from identity verification.

Categories of consumer health data. Images of your face (your selfie and the photo on your ID) and the facial measurements made from them.

What we collect and why. Before your first catalog order, Stripe, our identity-verification provider, captures a selfie and a photo of your government-issued photo ID. It measures facial features in both to check that they match. Our team can view the selfie and ID photo in our Stripe account, and does so only if an order needs a manual review, you ask us to help with your verification, or a tool isn't returned, comes back damaged or is missing from the return box, or there's a payment dispute. We never receive the facial measurements. We use this data only to confirm that the person ordering is you, to decide whether an order needs review before it ships, to prevent fraud and misuse of our tools (including a tool that isn't returned, is returned damaged or is missing from the return box), and, if there's a dispute, to show that you placed the order and accepted your agreement.

Where it comes from. From you, through Stripe Identity. Stripe may also check your information against third-party and government sources.

Consent. We ask for your consent before the check starts. We ask separately for your consent to Stripe using this data for its own purposes, described below.

What is shared, and with whom. Stripe, Inc. (privacy@stripe.com) collects and holds your selfie, your ID photo and the facial measurements made from them, on our behalf, to run the check. Separately, Stripe also uses this data for its own purposes, such as security, fraud prevention, operating and improving its services, and meeting its legal obligations, under its own privacy policy (https://stripe.com/privacy). We have no affiliates. We don't share this data with anyone else, except with courts or law enforcement when the law requires it, and we never sell it. ToolBNB doesn't store your selfie, ID photo or facial measurements on its own systems; they're held by Stripe.

Your rights. You can:

• confirm whether we collect, share or sell your consumer health data, and get a copy of it, along with a list of every third party and affiliate we have shared it with and an email address for contacting each of them;
• withdraw your consent to our collection and sharing of it; and
• have it deleted. When you do, we have Stripe redact the data it holds for us, and we tell Stripe about your request. Because we hold none of this data on our own systems, there is nothing of it in our backups to delete.

How to make a request. Email info@toolbnb.net from your account email address. We'll respond within 45 days. If we reasonably need more time, we may extend that once by 45 more days, and we'll tell you why within the first 45 days. Responses are free up to twice a year. If we decline your request, you can appeal by replying "Appeal" to our answer, and within 45 days we'll tell you in writing what we did and why. If we deny your appeal, you can file a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.