DataBud Privacy Policy

1. Who We Are

DataBud is operated by Raindrop, LLC, a company registered in Puerto Rico. References to "we," "us," and "DataBud" in this Policy mean Raindrop, LLC. This Policy applies to the Services we operate, but does not apply to:

• Consumer health data (covered by the DataBud Consumer Health Data Privacy Policy);
• The cannabis products themselves, which are manufactured and sold by separately licensed cannabis operators that have their own privacy practices; or
• Third-party websites or services linked from the Services.

2. The Licensee Subdomain Redirect

In some jurisdictions, regulators require that QR codes printed on cannabis product packaging point to a domain controlled by the licensed cannabis operator. In those cases, the QR code may take you first to a subdomain operated by the licensed operator (for example, databud.[licensee-domain].com), which automatically redirects you to the DataBud Services at databud.ai. The licensed operator's subdomain is governed by the operator's own privacy policy, which you should review separately. Once you are redirected to the DataBud Services, this Policy and our DataBud Consumer Health Data Privacy Policy apply.

3. Information We Collect

We collect personal information in the following categories:

• Account and Contact Information: Name, email address, phone number, and any other information you provide when you create an account or contact us;
• Communication Preferences: Your stated preferences for receiving email, phone, or text messages;
• Device and Usage Data: Information automatically collected about your device and your interactions with the Services, such as IP address, device type and operating system, browser type, pages visited, referring URL, and timestamps;
• Cookies and Similar Technologies: Information collected through cookies, pixels, and similar technologies as described in Section 8 below; and
• Inferences: Inferences we draw from the categories above to support service operations and personalization, excluding any inferences derived from consumer health data, which are addressed in the DataBud Consumer Health Data Privacy Policy.

We do not collect Social Security numbers, government identification numbers, financial account numbers, or precise geolocation through the Services. If you choose to participate in a sweepstakes or promotion, additional information may be collected as described in the official rules of that promotion.

4. How We Use Your Information

We use the personal information described in Section 3 for the following purposes:

• Providing the Services: To create and maintain your account, deliver the Services you request, and provide customer support;
• Service Improvement: To analyze how the Services are used, diagnose technical issues, and improve features and performance;
• Communications: To send you service updates and respond to your inquiries through the channels you have opted into;
• Marketing: To send promotional content about DataBud, but only where you have separately opted in. You may opt out of marketing communications at any time;
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent or unauthorized use of the Services; and
• Legal Compliance: To comply with applicable laws and respond to lawful requests from public authorities.

AI-assisted features. The Services may use machine learning and AI systems to power features such as personalized informational guidance and customer support. Where you interact with an AI system that could reasonably be mistaken for a human, we will identify it as an AI. We do not use AI systems to make decisions that produce legal or similarly significant effects on you without meaningful human review.

5. How We Share Your Information

We do not sell your personal information. We share your personal information only as follows:

• Service Providers (Processors): With trusted vendors that help us operate the Services (for example, cloud hosting, analytics infrastructure, customer support tools, and email delivery). These vendors process information on our behalf under written contracts;
• Licensed Cannabis Operators: We may share de-identified, aggregated insights with licensed cannabis operators to help them improve their products and consumer education. We do not share identifiable account or contact information with cannabis operators except where you have separately opted in;
• Legal Compliance and Safety: When we believe in good faith that disclosure is required by law, regulation, or legal process, or is necessary to protect the rights, property, or safety of any person;
• Business Transfers: In connection with a merger, acquisition, financing, or sale of assets, business records may transfer to the acquirer. Transfers of consumer health data are subject to the additional restrictions in the DataBud Consumer Health Data Privacy Policy; and
• With Your Consent: In any other situation where we have your consent.

6. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account information: Retained for the life of your account, plus a reasonable wind-down period after closure;
• Device and usage logs: Retained for a limited period (typically 12 to 24 months) for security and performance purposes, then deleted or aggregated;
• Marketing records: Retained for as long as you are opted in, plus a reasonable period to honor opt-out requests; and
• Records related to legal claims, regulatory inquiries, or sweepstakes administration: Retained for the period required by applicable law (for sweepstakes, generally not less than four (4) years).

7. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, access controls, and contractual restrictions on service providers. No security program is perfect, but we work to apply current industry-standard practices.

8. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to operate the Services and to understand how they are used. The categories include:

• Strictly Necessary: Required for core site functionality (for example, session management and security). These cannot be disabled through our cookie controls;
• Performance and Analytics: Help us understand how the Services are used so we can improve them. We use first-party analytics; where third-party analytics are used, the provider is bound by a data processing agreement that limits its use of the data;
• Functional: Remember your preferences (such as language or display settings); and

We do not place advertising or behavioral retargeting cookies on pages where consumer health data is collected or displayed. See the DataBud Consumer Health Data Privacy Policy for details.

You can manage cookies through your browser settings. We honor the Global Privacy Control ("GPC") signal as a request to opt out of the sale or sharing of personal information for cross-context behavioral advertising in the jurisdictions where it applies.

9. Your Rights

Depending on where you live, you may have rights regarding your personal information, including:

• Access: Request a copy of the personal information we hold about you;
• Correction: Request that we correct inaccurate or incomplete information;
• Deletion: Request deletion of your personal information, subject to legal exceptions;
• Data Portability: Request a copy of certain information in a structured, commonly used format;
• Opt-Out of Marketing: Opt out of marketing communications at any time; and
• Withdraw Consent: Where we rely on your consent, withdraw it at any time. Withdrawal does not affect processing carried out before the withdrawal.

To exercise these rights, contact privacy@databud.ai. We will respond within forty-five (45) days, or longer where extended response time is permitted by law (with notice to you).

Rights related to consumer health data — including the rights to confirm, access, withdraw consent, delete, and appeal — are set forth in the DataBud Consumer Health Data Privacy Policy. Washington residents and other state residents with applicable health data laws should consult that policy.

10. Children

The Services are not directed to and may not be used by anyone below the legal cannabis consumption age in their jurisdiction (and in no event below 21 years of age in the United States). We do not knowingly collect personal information from anyone below that age. If you believe we have collected information from such a person, contact us at privacy@databud.ai and we will delete it.

11. International Transfers

Raindrop, LLC is based in Puerto Rico and we use service providers located in the United States and elsewhere. By using the Services, you understand that your personal information may be transferred to, stored in, and processed in the United States, Puerto Rico, and other jurisdictions. We use contractual and technical safeguards to ensure that transferred information remains protected at a level consistent with this Policy.

12. Governing Law and Jurisdiction

This Policy is governed by the laws of the Commonwealth of Puerto Rico, without regard to its conflict of law principles. Except as set forth in the carve-out below, claims arising from this Policy will be brought exclusively in the courts located in San Juan, Puerto Rico.

Carve-Out for Washington Residents. Notwithstanding the foregoing, if you are a Washington resident or your information was collected in Washington, you may bring claims arising under Washington law (including the Washington My Health My Data Act, RCW Chapter 19.373, and the Washington Consumer Protection Act, RCW Chapter 19.86) in a Washington state or federal court of competent jurisdiction, and those claims will be governed by Washington law. Nothing in this Policy waives any non-waivable right under Washington law.

13. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will provide notice through the Services or by other reasonable means and will update the "Last Updated" date above. Material changes affecting how we treat previously collected information will not be applied retroactively without your separate consent or as required by law.

14. Contact Us

If you have questions about this Policy or want to exercise your rights, contact us at: