Privacy Policy

Exhibit 101 (exhibit101.com) is an independent research publication cataloguing restaurant fraud schemes for operators, auditors, and fraud-detection professionals. References to "we", "us", or "our" in this policy refer to the Exhibit 101 team.

We collect the following categories of personal data:

• Registration data: Name, email address, and optional WhatsApp number when you register for handbook updates.
• Download requests: Email address used to generate a secure handbook download link.
• Fraud reports: Any information you voluntarily submit via the Report a Fraud form, which may include descriptions of incidents.
• Usage data: Page views and interaction events collected via Google Analytics 4 (GA4) using anonymised identifiers.
• Technical data: IP address, browser type, and device information collected automatically by our hosting infrastructure.

• To send you the handbook and related research updates you opted into.
• To generate and deliver secure one-time PDF download links.
• To process and review anonymised fraud reports for future handbook editions.
• To understand how visitors use the site and improve content (analytics).
• To send administrative notifications (e.g. OTP verification codes).

If you are located in the European Economic Area (EEA), our legal bases for processing are:

• Consent — for marketing communications and analytics cookies. You may withdraw consent at any time.
• Legitimate interests — for fraud-report processing and site security.
• Contract performance — to deliver the handbook you requested.

We use Google Analytics 4 to collect anonymised usage statistics. GA4 is loaded only after you accept analytics cookies via our cookie consent banner. You may opt out at any time by declining cookies or using the Google Analytics Opt-out Browser Add-on.

We use Cloudflare Turnstile for bot protection on registration forms. Turnstile may set a functional cookie. No personal data is shared with Cloudflare beyond what is technically necessary for the challenge.

We do not sell your personal data. We share data only with:

• GoDaddy / Airo — our hosting and infrastructure provider.
• Google Analytics — anonymised usage data only.
• Cloudflare — bot-protection challenge data.
• CallMeBot — WhatsApp notification service, used only if you provided a WhatsApp number and opted in.

Registration records are retained for as long as you remain subscribed. Download tokens expire after 24 hours and are purged within 30 days. OTP codes expire after 10 minutes. Fraud reports are retained indefinitely for research purposes in anonymised form. You may request deletion at any time (see Section 9).

Your data may be processed in the United States or other countries where our service providers operate. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards for transfers outside the EEA.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion ("right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time without affecting prior processing.

To exercise any of these rights, email us at [email protected].

We implement industry-standard security measures including HTTPS, hashed credentials, rate-limited OTP codes, and single-use download tokens. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

Exhibit 101 is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the site after changes constitutes acceptance of the updated policy.

Questions about this policy? Contact us at [email protected].