Storable, Inc. Corporate Site Privacy Policy

Last updated and effective date: September 30, 2026

Introduction

This Privacy Policy describes how Storable, Inc. and the applicable Storable-affiliated entity that operates the relevant
website, application, product, or service (collectively, “Storable,” “we,” “us,” or “our”) collect, use, disclose, and
otherwise process personal information. This Privacy Policy also tells you about the rights and choices you have with
respect to your Personal Information. “Personal Information” is described in the Categories of Personal Information
We Collect and Disclose section below.

Storable, Inc. is located at 10900 Research Blvd., Ste. 160C PMB 3099, Austin, TX 78759, and may be contacted at
[email protected].

By accessing or using a website, application, product, or service where this Privacy Policy is posted or linked
(collectively, the “Platform”), you acknowledge this Privacy Policy. Where required by applicable law, we will obtain
your consent before processing your Personal Information on the basis of consent. Where applicable, this Privacy
Policy is incorporated by reference into the relevant terms governing your use of the Platform.

Please read this Privacy Policy carefully to understand our policies and practices regarding your information and how
we will treat it. If you do not agree with any part of this policy, then please do not use the Platform.

When This Privacy Policy Applies

This Privacy Policy is Storable’s base customer-facing privacy policy. Additional entity-specific, brand-specific, product-
specific, and jurisdiction-specific privacy notices may apply depending on the Storable entity, brand, offering, your
location, or the law that applies. Where an additional notice applies, it should be read together with this Privacy
Policy and will control over this Privacy Policy to the extent of any conflict. This Privacy Policy covers Storable’s
customer-facing operations and applies to the Personal Information Storable obtains in various contexts, including
when you:
access or use our websites, mobile websites, Platforms, web-based applications, or mobile applications that
Storable operates and that link to this Privacy Policy, as well as connected devices or access-control systems that
we provide to customers;

• access or use our products and services made available by Storable and its brands across our business verticals;
• communicate with us via phone, email, text, chat, virtual assistants, and other forms of electronic messages,
  including on social media;
• interact with media integrations, advertising tools, or third-party platforms;
• interact with third-party partners, providers, or service providers we work with to offer, provide, and improve our
  products and services; or
• interact with us offline, including by attending programs or events.

This Privacy Policy applies to the Personal Information collected through our Platform, regardless of the country
where you are located. In some circumstances, Storable may process Personal Information on behalf of business
customers or providers as a service provider or processor. In those cases, the relevant customer’s, or provider’s privacy notice or other applicable contractual or legal terms may govern certain aspects of that processing, and
individuals should direct requests relating to that data to the relevant customer or provider where appropriate. This
Privacy Policy generally applies where Storable acts as a controller or business under applicable privacy law.

When This Privacy Policy Does Not Apply

This Privacy Policy does not apply to Personal Information collected from Storable employees, applicants, contractors,
or other workforce members, which is addressed in separate notices where applicable. This Privacy Policy also does
not apply to information collected and processed independently by third parties through their own websites,
applications, services, or technologies, which remains subject to their own privacy notices and practices. Providers
and other third parties are independent entities responsible for their own privacy practices once Personal Information
is shared with them unless applicable law or contract provides otherwise. In addition, this Privacy Policy is not
intended to limit any rights or obligations that cannot be waived or modified under applicable law. If any provision of
this Privacy Policy conflicts with applicable law, the applicable law will govern to the extent of the conflict.

Relationship to Terms of Service

This Privacy Policy governs the collection, use, disclosure, and other processing of Personal Information. The
applicable terms of service, terms of use, or other governing terms for the Platform (collectively, the “Terms of
Service”) govern your access to and use of the Platform, including matters such as eligibility, account rules,
disclaimers, limitations of liability, and dispute resolution. If there is a conflict between this Privacy Policy and the
applicable Terms of Service, this Privacy Policy controls with respect to Personal Information processing, and the
Terms of Service control for all other matters, except where applicable law requires otherwise.

Relationship to Data Processing Agreement (“DPA”)

If you access or use the Platform or Services on behalf of a business or other organization, any Personal Information
that we process on that organization’s behalf in connection with the Services constitutes “Customer Data” under our
Data Processing Agreement (“DPA”). Storable may provide the DPA in web form on its Privacy page. An executable
copy of the DPA is available upon request by contacting [email protected].

The DPA may be accepted electronically through the web version posted on Storable’s Privacy page. The web version
operates as a written electronic agreement and does not require separate execution, except to the extent a signature
or other specific formality is required by applicable law or the applicable governing agreement. A business customer’s
acceptance of the applicable governing agreement and access to or use of the Services after the web version is posted
constitutes acceptance of the DPA to the extent legally effective. If Storable and a business customer execute a
separate DPA, that signed DPA will govern from its effective date and supersede the web version to the extent of any
conflict.

The DPA supplements the applicable Terms of Service, order form, and any other governing agreement for the
Services. The DPA governs the parties’ rights and obligations regarding the Processing and security of Customer Data.
If there is any conflict or inconsistency between this Privacy Policy, the applicable Terms of Service or other governing
agreement, and the DPA, the DPA controls with respect to the Processing and security of Customer Data, except to
the extent applicable law requires otherwise.

This Privacy Policy governs Personal Information that we process as a controller or business, including Personal
Information relating to Customer representatives, administrators, authorized users, and other individuals who interact with us in connection with the Platform or Services. This Privacy Policy does not replace or modify the DPA
with respect to Customer Data.

Privacy at a Glance

• We collect Personal Information such as contact details, account information, usage data, location-related data,
  payment-related information, and identifiers linked to your browser, device, visit, messages, and interactions
  with us so we can operate our products and services, support users, understand and improve how our services
  are used, maintain security, and comply with legal obligations.
• We use this information to provide and improve our services, operate our Platform and mobile applications,
  secure our systems, personalize user experiences, understand how people use our Platform and services over
  time, measure how well our communications and marketing efforts perform, and send communications,
  including marketing communications where permitted by law.
• We do not sell Personal Information for monetary consideration, but depending on the Storable brand, offering,
  your location, and the law that applies, we may use cookies and similar technologies, share certain information
  with analytics and partners, and use identifiers created or used on our own websites, apps, services, or messages
  to support analytics, understand what leads people to visit, inquire, reserve, or transact, help continue
  experiences across visits or devices where permitted by law, personalize content, maintain security, prevent
  fraud, and, where permitted by law, support cross-context behavioral advertising or targeted advertising, subject
  to applicable rights and legal requirements.
• You may have rights under applicable privacy law, including rights to access, delete, correct, or restrict Personal
  Information, and to opt out of certain uses such as targeted advertising or certain profiling.
• You can manage certain cookies and tracking technologies through our preference tools and browser settings,
  and you may exercise privacy rights through our privacy request portal.
• We take reasonable measures to protect your information, retain it as long as necessary, and apply appropriate
  safeguards for international data transfers where required.

Categories of Personal Information We Collect and Disclose

We have collected the following categories of Personal Information from consumers within the last 12 months to
support business operations, including for the business purposes described below. The examples listed in each
category are illustrative and not exhaustive. Not every category is collected from every individual, used for every
purpose, or disclosed to every type of recipient listed below.

Depending on the context, this may also include session, reservation, inquiry, account, tenant, and campaign-related
records, and records that help us understand and connect interactions across visits, devices, channels, reservations,
transactions, move-ins, and other stages of your relationship with us, subject to applicable law.

Category	Example Data Elements
Identifiers and contact information	Real name; email address; home address; telephone number; username; unique personal identifiers such as cookies, beacons, and pixel tags, and other identifiers created or used on our own websites, apps, services, or messages; identifiers associated with a browser, device, visit, communication, or customer interaction; IP address; proxy server address; and campaign, referral, or similar information that helps us understand how you found us or interacted with our services where collected
Government identifiers and payment or financial account information	Driver’s license number; credit card number; debit card number; bank account number with routing number
Device, browser, and usage information	Browser type; browser settings; date and time stamps associated with Platform usage; pages and files viewed; searches; Platform features used; internet service provider; mobile carrier; device identifiers; interaction events; conversion information about whether you took an action, such as submitting a request, making a reservation, starting or completing a transaction; referral or campaign information; links clicked; landing pages; page flows; engagement data; and related analytics, measurement, performance, and diagnostic information
Demographic information	Age; date of birth where collected; profile or demographic details voluntarily provided
Location-related information	Approximate location information derived from IP address or device signals; precise device-location information where collected and subject to applicable legal requirements
Support, communications, and transactional information	Inquiry content; customer support communications; reservation details; transaction details; account credentials; call recordings; chatbot and virtual-agent messages, including chat logs, transcripts, and human-handoff notes where collected; communications and engagement history; and inquiry, booking, reservation, move-in, payment, tenant, account, or other records connected to your relationship with our products and services

Depending on the context and as permitted by law, we may also collect and disclose sensitive Personal Information
for limited business purposes. Examples may include government-issued identifiers, financial account and payment
information, and precise geolocation. We use and disclose sensitive Personal Information only as permitted by law
and for the purposes described in this Privacy Policy. Where required by applicable law, we obtain consent before
processing sensitive Personal Information for purposes that require consent.

How We Collect Personal Information

Source Category	Description
Information You Provide	Personal Information that you voluntarily provide when you register for a service or product; submit an inquiry, booking, or reservation request; communicate with us or a provider through the Platform, including through a chatbot or virtual agent; make a transaction; create an account; sign up for marketing communications; or otherwise contact us
Information Collected Automatically	Information automatically collected by us and third parties we work with when you visit, use, or navigate the Platform using cookies, pixels, SDKs, beacons, log files, session replay tools, system connections that allow our websites, apps, and services to exchange information, information included in links or URLs, and similar technologies. Depending on the context, these technologies may help us recognize a browser, device, visit, communication, or other interaction over time; understand how users move across pages, visits, messages, devices, channels, or certain Storable digital properties; measure campaign and product performance; maintain security; and detect fraud, all subject to applicable law
Information from Third Parties	Personal Information received from providers, advertising and analytics partners, social media platforms, measurement, fraud prevention, and identity verification service providers, publicly available sources, corporate affiliates, and other third parties acting consistently with this Privacy Policy or another applicable notice

How We Use Personal Information

We may use Personal Information for the following business and commercial purposes:

• operating, maintaining, and administering the Platform, products, and services;
• processing inquiries, bookings, reservations, transactions, account access, and related requests;
• communicating with you, including to respond to your requests, submissions, and inquiries; to request feedback;
  and to send service, administrative, legal, technical, security, and other important updates about the Platform,
  our products and services, this Privacy Policy, and applicable terms;
• verifying identity, authenticating accounts, and processing privacy rights requests;
• customer support and service communications;
• analytics, reporting, testing, research, surveys, and product development, including to better understand how
  users access and use the Platform, products, and services; to evaluate and improve our business operations; and
  to develop, improve, and enhance features, offerings, and services;
• creating, maintaining, validating, using, or improving identifiers and related records associated with browsers,
  devices, visits, communications, inquiries, reservations, transactions, accounts, or similar interactions to better
  understand the steps people take before contacting us, making a reservation, or completing a transaction; to
  measure engagement and service performance; to support analytics and reporting; to improve our products and
  services; and to maintain business records, where permitted by law;
• linking, associating, or otherwise relating information collected across visits, devices, browsers, communications,
  channels, digital properties, products, services, inquiries, reservations, transactions, or other interactions where
  reasonably necessary to provide services, respond to requests, continue experiences across visits or devices,
  support analytics, measure how communications or marketing perform, personalize experiences, prevent fraud,
  investigate incidents, or improve business operations, subject to applicable law;
• using referral, campaign, engagement, and similar data to understand whether an ad, email, text message,
  referral source, or earlier interaction contributed to a later inquiry, reservation, transaction, or similar action,
  where permitted by law, linking related interactions, inquiries, reservations, transactions, move-ins, and account
  activity across visits, devices, channels, and certain Storable digital properties to support analytics, attribution,
  reporting, fraud prevention, customer support, and service improvement, where permitted by law;
• detecting, preventing, investigating, and responding to suspicious, fraudulent, abusive, unauthorized, or unlawful
  activity, including by using device, browser, network, IP address, location-related, and similar signals as security
  and fraud-prevention indicators, rather than relying on any single signal alone to identify a particular person
  where that would not be appropriate or permitted by law;
• maintaining, defending, documenting, or operationalizing our privacy, security, and compliance programs,
  including honoring consent choices, opt-out requests, and privacy rights requests; suppressing future collection
  or use where required; de-identifying, aggregating, or separating directly identifying information from other
  records where appropriate; and documenting our response to such requests as permitted by law;
• identifying, troubleshooting, and resolving bugs, errors, and performance issues, and assessing, securing,
  optimizing, and improving the functionality and performance of the Platform, products, and services;
• marketing and advertising, including targeted advertising where permitted by law;
• fraud prevention, security, abuse prevention, and incident response, including to protect our business operations,
  assets, systems, networks, personnel, users, and the Platform, and to investigate, prevent, detect, and take action
  regarding unauthorized activities or potential threats to rights, safety, or security;
• personalization of content, recommendations, communications, support, and user experience;
• billing, payments, collections, financial administration, corporate governance, audits, investigations,
  recordkeeping, compliance, and related business operations;
• legal compliance and the establishment, exercise, enforcement, and defense of our rights and interests, including
  in connection with claims, disputes, investigations, regulatory matters, and litigation;
• carrying out, supporting, or evaluating actual or contemplated mergers, acquisitions, divestitures, asset sales, financings, restructurings, reorganizations, bankruptcies, or other business transactions; and
• fulfilling any other purpose disclosed at or before the time Personal Information is collected, or otherwise with your consent where required by law.

Disclosure of Personal Information

We may disclose Personal Information to the following categories of recipients:

• our subsidiaries and affiliates;
• service providers, contractors, and vendors that provide operational services such as hosting, payment
  processing, customer support, security, analytics, infrastructure, communications, CRM, finance, chatbot and
  virtual-agent operation, and related services;
• analytics, attribution, reporting, identity-resolution, and customer data platform service providers that help us
  connect related interactions and generate insights or reports on our behalf, subject to applicable law and
  contract;
• SMS and mobile messaging vendors that send or process messages on our behalf under appropriate contracts;
• providers and other business partners when you submit an inquiry, booking, reservation, or other request
  through the Platform;
• advertising networks, social media platforms, and marketing partners that assist with interest-based advertising,
  cross-context behavioral advertising, targeted advertising, retargeting, attribution, and related functions, subject
  to applicable law;
• analytics, measurement, testing, fraud prevention, and related service providers that help analyze usage
  patterns, traffic, engagement, Platform performance, information whether users take actions such as submitting
  requests, making reservations, or completing transactions, product effectiveness, security events, and similar
  operational or marketing metrics;
• corporate affiliates within the Storable corporate group for operational, administrative, support, security,
  analytics, product, and related purposes; and
• courts, regulators, law enforcement, tax authorities, government bodies, insurers, auditors, advisers, and other
  recipients where disclosure is required or permitted by law or necessary to protect rights, safety, security, or the
  Platform.

We may also provide aggregated information (consisting of combined information of a number of individuals but that
does not identify those individuals) to third parties, who may use such information to analyze patterns or statistics
regarding use of our products and services. Where we share information across Storable brands and services, such
sharing is subject to this Privacy Policy or a substantially similar privacy notice and to applicable contracts, internal
policies, and legal requirements requiring the relevant Storable entity to protect Personal Information appropriately.

SMS and Mobile Messaging

When you provide a mobile phone number and consent to receive SMS or MMS messages from us (for example,
account alerts, reminders, or other text communications), we use that information only to send the messages you
have requested or that are otherwise permitted by law in connection with our products and services. We do not
share text-messaging originator opt-in data and consent, or mobile numbers used for SMS/MMS programs, with third
parties or affiliates for their own marketing or promotional purposes, except for vendors that send or process such
messages on our behalf under appropriate contracts.

Cookies, Pixels, Session Replay, and Tracking Technologies

We and our third-party partners use cookies on our Platform. We and our partners may also use pixels, SDKs,
beacons, tags, session replay tools, system connections that allow our websites, apps, and services to exchange
information, information included in links or URLs, and similar technologies to operate the Platform and support
analytics, functionality, security, personalization, and, where permitted by law, advertising. Not all Storable brands,
offerings, or digital properties use the same cookies or tracking technologies.

Where permitted by law, these technologies and related identifiers may help us recognize visits or interactions over
time or across certain Storable websites, apps, or services; understand whether an earlier interaction led to a later
inquiry, reservation, transaction, or move-in; and support analytics, reporting, fraud prevention, personalization, and
service improvement.

Depending on the Storable brand, offering, your location, and the law that applies, additional cookie or tracking
disclosures may apply. Please review any applicable cookie notice, preference center, or related supplemental notice
for more information about the technologies used and the choices available to you. To the extent required by law, we
will provide notice, obtain consent, or offer applicable opt-out choices relating to certain cookies or similar
technologies. Where we use session replay or similar technologies, we configure them to mask or exclude sensitive
fields, such as payment card information, government identifiers, and other sensitive data, to the extent technically
feasible. We may also limit, suppress, separate, or disable certain identifiers, flows, or uses in response to consent
choices, opt-out requests, browser-based preference signals, or privacy rights requests where required by law.

Sale, Sharing, and Targeted Advertising

We do not sell Personal Information for monetary consideration. Depending on the Storable brand, offering, your
location, and the law that applies, we may “share” Personal Information, as that term is defined under applicable
privacy laws, for cross-context behavioral advertising or related targeted advertising purposes. Where required by
law, you may have the right to opt out of targeted advertising, cross-context behavioral advertising, sharing of
Personal Information, and certain profiling activities. Depending on the context and applicable law, some uses of
cookies and similar technologies for analytics, advertising, and performance measurement may be subject to the
same rights and choices that apply to targeted advertising, profiling, sharing, or similar regulated processing, and we
will provide those rights and choices where required by law.

Automated Tools, AI, Chatbots, and Virtual Agents

Some of our products and services, as well as certain customer support interactions, may use automated tools,
including chatbots, virtual agents, artificial intelligence (“AI”), and machine learning (“ML”) technologies, some of
which may be provided by third parties. Where applicable, we may make chatbots or virtual agents available as part
of these products, services, or interactions. These tools may assist with functions such as answering questions,
routing, or summarizing support requests, helping users identify products or services, facilitating reservations or other
requests, supporting human handoffs, improving customer support responses, enhancing product performance, and
analyzing system usage.

When we use AI or ML systems, we may process information such as account details, usage data, support
communications, including chat transcripts and call recordings, and operational data as inputs to provide, maintain,
secure, and improve our services.

Where we make a chatbot or virtual agent available, we may record and retain the chat log and related information,
which may include your messages, the tool’s responses, the date and time of the interaction, the pages or service
areas involved, technical and device information, identifiers, contact information you provide, reservation or inquiry
details, and notes or records relating to any human handoff.

We may use this information to respond to inquiries, provide and coordinate customer support, facilitate a handoff to
a human representative, review and improve the quality of our interactions, investigate and resolve disputes,
troubleshoot and secure our systems, prevent abuse and fraud, maintain business and compliance records, and
improve our products and services. We may permit authorized personnel and service providers acting on our behalf
to access or process these records for those purposes. We may associate chat records with an account, inquiry,
reservation, customer, campaign, or other interaction when reasonably necessary to provide services, respond to
requests, support analytics, or maintain business records, subject to applicable law.

If we process chatbot or virtual-agent interactions on behalf of a business customer as a service provider or
processor, the applicable customer’s privacy notice, instructions, and contractual terms may govern that processing.
Chat records may be stored or processed in countries identified in the International Transfers section and retained in
accordance with the Data Retention section. Where required by applicable law, we will provide additional notice or
obtain consent before recording, retaining, or using chatbot interactions.

We do not use AI- or ML-based systems to make decisions about you that are based solely on automated processing
and produce legal or similarly significant effects unless we provide the notice and rights required by applicable law.
Where such technologies are used, they are generally used to support human decision-making rather than replace it.

Your Privacy Rights and How to Exercise Them

Depending on applicable law and the context in which we process your information, you may have the right to know
or access, delete, correct, or obtain a portable copy of Personal Information; to opt out of certain uses such as
targeted advertising, sharing, sale, or certain profiling; to limit certain uses or disclosures of sensitive Personal
Information where applicable; to object to or restrict certain processing where applicable; to withdraw consent
where processing is based on consent; and to appeal certain decisions regarding a privacy request where applicable
law requires an appeal process. Likewise, under the General Data Protection Regulation (EU) 2016/679 (“EU-GDPR”)
or the UK General Data Protection Regulation (“UK-GDPR”; collectively, “GDPR”), data subjects who either (i) are in
the EU or the UK or (ii) are affected by processing activities in the context of an establishment of Storable in the EU or
the UK have specific rights regarding their Personal Information.

To submit a privacy request or ask a privacy question, please contact us at [email protected] or use our privacy
request portal at https://privacyrequest.storable.com/. Your request must describe the request in sufficient detail to
allow us to properly understand, evaluate, and respond to it, and provide sufficient information to allow us to
reasonably verify that you are the person about whom we collected Personal Information or an authorized
representative.

Under certain circumstances and where permitted by law, we may deny or limit a request, including where we cannot
verify identity or authority, where an exception applies, or where the information is maintained solely in our role as a
processor or service provider for a customer or provider. Where required by law, we will describe the basis for a
denial and explain any available appeal process. We will not discriminate against you for exercising privacy rights
conferred by applicable law.

Subject to applicable law, when we receive and verify a privacy request, we may delete, correct, suppress, restrict,
de-identify, aggregate, or separate certain Personal Information or identifiers, as appropriate to honor the request,
comply with law, preserve legally permitted records, protect security and system integrity, prevent fraud, resolve
disputes, or maintain internal business records, analytics, debugging, or reporting information in a form permitted by
law. In some cases, this may include removing or reducing the ability to connect a record, identifier, or interaction
history to a particular individual while retaining information in de-identified, aggregated, or otherwise non-personally
identifiable form where permitted by law.

GDPR Legal Bases

Under the GDPR, we are only allowed to process your Personal Information where we have a legal basis to do so. For
those processing activities described above that are subject to the GDPR, we rely in particular on the following legal
bases:

• performance of a contract, where processing is necessary for the performance of a contract to which you are
  a party or to take steps at your request prior to entering into the contract;
• compliance with legal obligations, where processing is necessary for us to comply with a legal obligation;
• legitimate interests, where processing is necessary for the legitimate interests we pursue except where such
  interests are overridden by your fundamental rights and freedoms; and
• consent, where required by law or where we otherwise choose to rely on consent for particular processing
  activities.

If required by applicable GDPR or UK GDPR requirements, Storable will identify in this Privacy Policy or in an
applicable supplemental notice, together with the relevant contact details.

Depending on the context, our use of identifiers, cookies, similar technologies, analytics, performance measurement,
personalization, security monitoring, fraud prevention, and related identity- or interaction-related processing may be
based on performance of a contract, legitimate interests, compliance with legal obligations, or consent; where
applicable law requires consent for certain cookies, similar technologies, advertising, or related processing, we will
rely on consent.

Data Retention

Except as otherwise permitted or required by applicable law or regulation, we will retain your Personal Information
for as long as necessary to fulfill the purposes for which we collected it, as required to satisfy legal, accounting, or
reporting obligations, to exercise our legal rights and defend claims, or as necessary to resolve disputes.

To determine the appropriate retention period for Personal Information, we consider applicable legal requirements,
the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or
disclosure, the purposes for which we process the Personal Information, and whether we can achieve those purposes
through other means.

Retention periods vary depending on the type of information and the purposes for which it is used. For example,
account, billing, and transaction records may be retained for the duration of the relationship and for an additional
period thereafter to comply with tax, accounting, audit, and legal obligations; support communications (including
chatbot, virtual-agent, and human-handoff communications) may be retained for a limited period to respond to
questions, improve quality, and resolve disputes; marketing contact information may be retained until you unsubscribe and thereafter as reasonably necessary to maintain suppression lists and document your preferences;
identifiers, event logs, campaign, referral, engagement, and similar analytics or measurement records may be
retained as reasonably necessary to operate, analyze, protect, debug, and improve our products, services, and
business operations, subject to applicable law; and security, fraud-prevention, and access logs may be retained as
reasonably necessary to protect our systems, investigate incidents, and comply with legal obligations. The actual
retention period for any category of Personal Information may vary depending on the context and applicable legal
requirements.

Where appropriate and permitted by law, we may also de-identify, aggregate, pseudonymize, or otherwise separate
Personal Information or identifiers from directly identifying information and retain the resulting information for
analytics, product improvement, security, fraud prevention, business reporting, or other legally permitted purposes.

Security

We maintain commercially reasonable safeguards to help protect Personal Information we have collected against
accidental loss and unauthorized use, disclosure, alteration, or destruction. We periodically assess, test, and review
our data security practices and consider appropriate updates to support compliance with applicable privacy and
information security requirements. However, no security system or method of transmitting or storing electronic data
is completely secure or impenetrable, and we cannot guarantee absolute security. If we determine that notification is
required in connection with a security incident involving Personal Information, we will provide notice in accordance
with applicable law.

International Transfers

Personal Information may be transferred to, stored in, or accessed from countries other than the country in which
you are located, including the United States. Where applicable law requires, we will implement appropriate
safeguards for such transfers, which may include the European Commission’s Standard Contractual Clauses, the UK
International Data Transfer Addendum, or other recognized transfer mechanisms, together with supplementary
measures where appropriate. Where we use cloud-based analytics, security, advertising, AI/ML tools, chatbots, or
virtual-agents that involve international transfers of Personal Information, those transfers are subject to the same
safeguards and contractual protections described in this section where required by law.

Children’s Privacy

Our products and services are intended for use by adults and business users. Where applicable, our products and
services may be used or entered into only by individuals who have reached the age of majority in their jurisdiction, or
by an authorized adult representative acting on behalf of a business or organization. We do not knowingly collect
Personal Information from individuals under 16 years of age unless otherwise permitted by law and supported by any
required consent or authorization. If you believe we have mistakenly or unintentionally collected Personal
Information from a child without appropriate consent or authorization, please contact us at [email protected]
and we will take steps to delete that information as required by law.

Do Not Track / Browser Signals

Our Platform does not respond to legacy “Do Not Track” browser signals that do not constitute a legally recognized
opt-out preference signal. We do, however, recognize browser-based opt-out preference signals, including Global
Privacy Control (“GPC”), where required by applicable law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices,
systems, technologies, offerings, or operations. We will update the “Last Updated” date and provide any additional
notice or obtain any additional consent required by law. Your continued use of the applicable Platform after any
revisions become effective means that the revised Privacy Policy will apply to your future use of the Platform to the
extent permitted by law.

Contact Us

To ask questions about this Privacy Policy or submit a privacy request, you can contact Storable at:
[email protected]; 10900 Research Blvd., Ste. 160C PMB 3099, Austin, TX 78759; and
https://privacyrequest.storable.com/.

Additional Disclosure for California Consumers

This section supplements the other parts of this Privacy Policy and applies only to California residents to the extent
the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and any implementing
regulations (collectively, the “CCPA”) apply. This section describes our California-specific notice disclosures, rights,
and methods for exercising those rights.

Categories of Personal Information. In the preceding 12 months, depending on the context, we may have collected
and disclosed the following categories of Personal Information about California consumers: identifiers and contact
information; customer records and account information; payment and financial information; internet or other
electronic network activity information; geolocation data; demographic information; communications and support
information; transactional information; and inferences or similar information derived from other Personal
Information where applicable. These categories may include cookies, similar technologies, other identifiers created or
used on our own websites, apps, services, or messages, device and browser identifiers, interaction and engagement
data, referral or campaign information, and other analytics or measurement-related information as described in this
Privacy Policy. We may also collect and disclose sensitive Personal Information, including government-issued
identifiers, financial account information, and precise geolocation, as described in this Privacy Policy.

Business and Commercial Purposes. We collect, use, and disclose California Personal Information for the business and
commercial purposes described in this Privacy Policy, including to operate and administer the Platform, process
transactions and requests, provide customer support, perform analytics and product improvement, understand and
measure user interactions and service performance, support reporting on how our communications and marketing
perform, market and advertise where permitted by law, maintain security, prevent fraud, comply with legal
obligations, and establish, exercise, or defend legal claims.

Sale and Sharing. We do not sell Personal Information for monetary consideration. We may, however, “share” certain
Personal Information, as that term is defined under California law, for cross-context behavioral advertising purposes.
Where required by California law, California residents may opt out of the sale or sharing of Personal Information. We
also recognize Global Privacy Control (“GPC”) signals where required by law. We do not knowingly sell or share the
Personal Information of consumers under 16 years of age without any affirmative authorization required by California law. Depending on the context and applicable law, some uses of cookies and similar technologies for analytics,
advertising, and performance measurement may be subject to the same rights and choices that apply to sharing or
similar regulated processing, and California residents may exercise those rights using the methods described in this
section.

California Rights. Subject to applicable exceptions and verification requirements, California residents may have the
right to request that we disclose the categories and specific pieces of Personal Information we have collected about
them; the categories of sources from which Personal Information is collected; the business or commercial purposes
for collecting, using, disclosing, selling, or sharing Personal Information; the categories of third parties to whom
Personal Information is disclosed; the categories of Personal Information sold or shared, if any; the categories of
Personal Information disclosed for a business purpose; the right to request deletion of Personal Information; the right
to request correction of inaccurate Personal Information; the right to opt out of sale or sharing; the right to limit
certain uses and disclosures of sensitive Personal Information where applicable; and the right not to receive
discriminatory treatment for exercising privacy rights under California law.

Exercising California Rights. California residents may submit privacy requests by contacting [email protected] or
by using our privacy request portal at https://privacyrequest.storable.com/. Only you, or a person legally authorized
to act on your behalf, may make a verifiable consumer request related to your Personal Information. We may need to
verify your identity or authority before completing your request. If you use an authorized agent, we may require
proof of the agent’s authorization and may also require you to verify your identity directly with us as permitted by
law.

Sensitive Personal Information. To the extent we collect sensitive Personal Information subject to California law, we
use and disclose it only for the purposes described in this Privacy Policy and as permitted by California law. Where
California law provides a right to limit certain uses or disclosures of sensitive Personal Information, California
residents may exercise that right using the request methods described above, where applicable.

Retention. We retain California Personal Information for the period reasonably necessary to achieve the purposes for
which it was collected or processed, as described in the Data Retention section of this Privacy Policy, unless a longer
retention period is required or permitted by law.