Effective Date: October 6, 2026

Vardera Labs, Inc. ("Vardera Labs," "we," "us," or "our") provides AI-powered visual identification, market value estimation and condition assessment services for physical collectible items through its cloud platform and web portal (the "Service"). This Privacy Policy describes how we collect, use, disclose and protect personal information when you interact with our website, portal and Service as described below.

Scope and Relationship to the Customer Terms. This Privacy Policy applies to personal information that Vardera Labs collects and processes as a controller in its own right — including account registration data, billing information, support correspondence, website and portal analytics, and marketing contacts. For Personal Data contained within Customer Data (as those terms are defined in the Vardera Labs Customer Terms), Vardera Labs acts solely as a processor or service provider on Customer's instructions, as described in Section 16 of the Vardera Labs Customer Terms, and Customer's own privacy notice governs the collection and use of that data. This Privacy Policy does not apply to such processing.

This Privacy Policy does not apply to any third-party websites, services or applications, even if they are accessible through the Service.

1. Information We Collect

1.1 Information You Provide to Us

Account registration: name, business name, business email address, phone number, billing address, and job title.

Payment information: processed by a third-party payment processor (such as Stripe). Vardera Labs does not store full payment card numbers; we retain only a payment token and limited card identifiers (last four digits, expiration date, card type) for transaction records.

Support and communications: information you provide when you contact us, including support tickets, emails, and any attachments.

Marketing preferences: if you opt in to receive marketing communications, your contact information and communication preferences.

1.2 Information Collected Automatically

When you access our website or portal, we automatically collect:

Device and browser information: IP address, browser type and version, operating system, device identifiers, and screen resolution.

Usage data: pages visited, features used, clickstream data, session duration, referring URLs, and search queries within the Service.

Log data: access times, server logs, error logs, and API call metadata.

Cookies and similar technologies: as described in Section 5 of this Privacy Policy.

1.3 Information from Third Parties

We may receive information from:

• Analytics and product telemetry providers that help us understand how our Service is used.

• Marketing platforms that provide information about businesses that may be interested in the Service.

• Publicly available business information.

2. How We Use Your Information

We use the personal information we collect for:

• Providing, maintaining and improving the Service

• Processing transactions and sending related information (invoices, confirmations)

• Creating and managing your account

• Responding to your requests, comments and questions and providing customer support

• Communicating with you about products, services, offers, promotions and events (only where you have opted in)

• Monitoring and analyzing trends, usage and activities in connection with the Service

• Detecting, investigating and preventing fraudulent transactions, abuse and other illegal activities and protecting our rights and property

• Personalizing and improving your experience with the Service

• Complying with legal obligations and enforcing our terms and policies

• Facilitating corporate transactions (mergers, acquisitions, asset sales)

• Any other purpose with your consent

We do not use personal information collected in our capacity as a controller for automated decision-making that produces legal or similarly significant effects on individuals.

3. How We Share Your Information

We do not sell personal information as that term is traditionally understood. We may share personal information with the following categories of recipients:

• Cloud hosting and infrastructure providers that store and process data on our behalf

• Payment processors that facilitate transactions

• Email and communications providers that deliver transactional and, where applicable, marketing communications

• Customer relationship management and marketing platforms

• Support and ticketing providers that help us respond to your inquiries

• Analytics and product telemetry providers that help us understand Service usage and performance

• Accounting, audit, insurance and professional advisors

• Law enforcement, regulators and other parties where required by applicable law, legal process or governmental request, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others, or to detect, prevent or address fraud or security issues

• Parties to corporate transactions: if Vardera Labs is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred as part of that transaction

• Other parties with your consent or at your direction

The specific service providers within each category may change from time to time. For a current list of providers, please contact us at info@varderalabs.com.

4. AI Training Disclosure

Vardera Labs retains and uses photographs, videos, images, factual item data and Service outputs (collectively referred to in the Vardera Labs Customer Terms as "Item Media," "Item Data" and "Results") that do not contain Personal Data to train, retrain, fine-tune, validate, benchmark and otherwise develop and improve its machine learning models. These models are made available to all of Vardera Labs' customers, including competitors of the submitting customer.

Personal Data is expressly excluded from all training use. Images of individuals incidentally captured in submitted photographs are treated as Personal Data under the Vardera Labs Customer Terms and are not used for training purposes. Vardera Labs does not perform facial detection, facial recognition, biometric identification or verification, and does not generate biometric identifiers or biometric information from submitted images — either for training or for any other purpose.

Persons who believe their image or other rights-protected material has been included in submitted photographs may contact us at info@varderalabs.com. Vardera Labs maintains a takedown process for bona fide third-party rights demands, as described in Section 6.4 of the Vardera Labs Customer Terms.

5. Cookies and Similar Technologies

5.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. We also use similar technologies including pixels (also known as web beacons or clear GIFs), tags, software development kits (SDKs) and local storage (collectively referred to in this section as "cookies") to collect information about your interactions with our website and portal.

5.2 Categories of Cookies We Use

Strictly Necessary Cookies. Required for the operation of our website and portal (authentication, security, load balancing). Cannot be disabled.

Functional/Preference Cookies. Enable enhanced functionality and personalization (language preferences, display settings, remembered choices).

Analytics Cookies. Help us understand how visitors interact with our website and portal by collecting and reporting information about usage patterns, page views and navigation paths. Vardera Labs uses one or more third-party analytics, product telemetry and performance monitoring services; the specific providers may change from time to time.

Advertising/Retargeting Cookies. Used to deliver relevant advertisements and track campaign effectiveness across platforms. These cookies may collect information about your browsing activities over time and across different websites.

5.3 Your Cookie Choices

You can control cookies through:

Browser settings: Most browsers allow you to refuse or delete cookies. Note that disabling cookies may affect the functionality of the Service.

Global Privacy Control: We recognize and honor the Global Privacy Control signal as a valid opt-out preference signal.

Opt-out links: Where we use advertising or retargeting cookies, we provide mechanisms to opt out of such tracking, as further described in Section 6 of this Privacy Policy.

For a current list of analytics and advertising technology providers, please contact us at info@varderalabs.com.

6. Sale or Sharing of Personal Information

Certain cookies and similar technologies described in Section 5 of this Privacy Policy may result in the "sale" or "sharing" of personal information as those terms are defined under the California Consumer Privacy Act (CCPA), the Colorado Privacy Act, or similar state privacy laws. Specifically, the use of advertising and retargeting cookies may constitute sharing of personal information with advertising partners for cross-context behavioral advertising.

Your Right to Opt Out. You may opt out of the sale or sharing of your personal information by:

• Submitting a request to info@varderalabs.com with the subject line "Do Not Sell or Share My Personal Information"

• Enabling the Global Privacy Control signal in your browser, which we recognize and honor as a valid opt-out of sale and sharing

• Adjusting your cookie preferences as described in Section 5.3

We do not knowingly sell or share the personal information of individuals under the age of 16.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, subject to a maximum retention period of seven (7) years from the date of collection or, for account-related data, from the date of account closure. Specific retention periods by category are as follows:

Account registration data: Retained for the duration of the account relationship and up to seven (7) years following account closure.

Billing and transaction records: Retained for up to seven (7) years following the transaction to comply with tax, accounting and legal obligations.

Support correspondence: Retained for up to three (3) years following resolution of the matter, unless a longer period is required.

Website and portal analytics: Retained in identifiable form for up to twenty-four (24) months; thereafter retained only in aggregated or anonymized form.

Marketing contact information: Retained until you withdraw consent or opt out, plus a suppression record retained indefinitely to honor your preference.

We may retain personal information beyond the periods stated above where required by applicable law or regulation, or where necessary to establish, exercise or defend legal claims.

8. Security

Vardera Labs maintains commercially reasonable administrative, physical and technical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, destruction or loss. These safeguards are consistent with the security obligations described in Section 7.3 of the Vardera Labs Customer Terms.

While we take reasonable measures to protect personal information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal information.

9. Your Privacy Rights

9.1 Rights Available

Depending on your state of residence, you may have some or all of the following rights with respect to the personal information we collect about you in our capacity as a controller:

Right to Know/Access. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources from which we collected it, the purposes for which we use it, and the categories of third parties with whom we share it.

Right to Delete. You may request that we delete personal information we have collected from you, subject to certain exceptions permitted by law.

Right to Correct. You may request that we correct inaccurate personal information we maintain about you.

Right to Data Portability. You may request a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.

Right to Opt Out of Sale/Sharing. You may opt out of the sale or sharing of your personal information, as described in Section 6.

Right to Opt Out of Targeted Advertising. You may opt out of the use of your personal information for targeted advertising purposes.

Right to Opt Out of Profiling. You may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Note: Vardera Labs does not currently use personal information collected as a controller for such profiling.

Right to Limit Use of Sensitive Personal Information. Where applicable, you may limit our use of sensitive personal information to purposes permitted by law. Note: Vardera Labs does not collect sensitive personal information for the purpose of inferring characteristics about individuals.

Right to Non-Discrimination. We will not discriminate against you or retaliate against you for exercising any of your privacy rights.

9.2 How to Submit a Request

You may submit a privacy rights request by:

• Emailing info@varderalabs.com with your request

• Submitting a request through the web form on our privacy page (when available)

Please provide sufficient information for us to verify your identity and to understand the nature of your request. Where you are submitting a request on behalf of another individual, please provide proof of your authorization to act on that person's behalf.

9.3 Verification

We verify the identity of individuals who submit requests by matching the information provided in the request against information we maintain in our account records. If we cannot verify your identity based on the information already in our possession, we may ask you to provide additional information solely for the purpose of verification.

9.4 Response Timeline

We will acknowledge receipt of your request within ten (10) business days. We will provide a substantive response within forty-five (45) days of receiving your verified request. If we require additional time, we may extend the response period by an additional forty-five (45) days, and we will notify you of the extension and the reason for it within the initial forty-five (45) day period.

9.5 Fees

We do not charge a fee for the first request submitted in any twelve (12) month period. For requests that are manifestly unfounded, excessive or repetitive, we may charge a reasonable fee to cover administrative costs, or we may decline to act on the request. We will notify you of any fee before processing the request.

9.6 Appeals

If we deny your request in whole or in part, you may appeal our decision by contacting us at info@varderalabs.com with the subject line "Privacy Rights Appeal." We will respond to your appeal within forty-five (45) days. If we deny your appeal, we will provide you with information on how to contact the attorney general in your state of residence to submit a complaint.

10. Marketing Communications

Vardera Labs provides marketing communications only to individuals who have provided their express opt-in consent. If you opt in to receive marketing communications, you may withdraw your consent at any time by:

• Clicking the "unsubscribe" link in any marketing email

• Emailing info@varderalabs.com with the subject line "Unsubscribe"

• Updating your preferences in your account settings

Withdrawal of marketing consent does not affect transactional communications related to your account or the Service (such as billing confirmations, security alerts, and service-related updates).

11. State-Specific Disclosures

The following disclosures supplement this Privacy Policy for residents of California, Colorado, Connecticut, Virginia and Utah.

11.1 Categories of Personal Information Collected

The following table maps the categories of personal information we collect to the statutory categories under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA):

• Identifiers — Collected: Yes. Name, email address, phone number, IP address, account identifiers

• Commercial Information — Collected: Yes. Transaction history, billing records, Plan selections

• Internet/Electronic Network Activity — Collected: Yes. Browsing history, search history, interaction with website and portal, log data

• Geolocation Data — Collected: No (precise) / Yes (approximate). IP-derived approximate location (city/state level)

• Professional/Employment Information — Collected: Yes. Job title, business name

• Sensitive Personal Information — Collected: No. Not collected for controller purposes

• Biometric Information — Collected: No. Not collected; no facial detection or biometric processing performed

• Audio, Electronic, Visual, Thermal, or Olfactory Information — Collected: No. Not collected for controller purposes (Item Media processed solely as a processor is excluded from this table)

• Inferences — Collected: No. Not drawn from controller-collected data

11.2 Sources of Personal Information

We collect personal information from the following sources: (a) directly from you (account registration, support requests, marketing opt-in); (b) automatically through your use of our website and portal (cookies, analytics, log data); and (c) from third-party sources (analytics providers, marketing platforms, publicly available information).

11.3 Business and Commercial Purposes for Collection

We collect and use personal information for the business and commercial purposes described in Section 2 of this Privacy Policy.

11.4 Disclosure of Personal Information

In the preceding twelve (12) months, we have disclosed personal information to the categories of recipients described in Section 3 of this Privacy Policy for the business and commercial purposes described in Section 2.

11.5 Sale or Sharing

As described in Section 6, certain advertising and retargeting cookies may constitute a "sale" or "sharing" of personal information under applicable state law. The categories of personal information that may be sold or shared through such technologies are: Identifiers (such as IP address and device identifiers) and Internet/Electronic Network Activity Information. We do not sell or share personal information of individuals we know to be under the age of 16.

11.6 Retention

Retention periods for each category of personal information are described in Section 7.

11.7 Authorized Agents

You may designate an authorized agent to submit a privacy rights request on your behalf. If you use an authorized agent, we may require: (a) written, signed authorization from you designating the agent; (b) verification of your identity as described in Section 9.3; and (c) confirmation directly from you that you have authorized the agent to act on your behalf.

11.8 Minors

The Service is directed to businesses and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a person under 16, we will take steps to delete that information.

11.9 Financial Incentives

We do not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.

12. International Users

The Service is operated from the United States. All personal information collected through the Service is processed and stored in the United States. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with applicable local laws. By using the Service, you consent to the transfer and processing of your information in the United States. This provision is consistent with Section 5 (International Use) of the Vardera Labs Customer Terms.

This Privacy Policy is drafted to comply with United States federal and state privacy laws. We do not intentionally market the Service outside the United States and do not maintain an establishment in any other jurisdiction.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time by posting a revised version on our website. The "Last Updated" date at the end of this Privacy Policy indicates the date of the most recent revision. Changes that are not materially adverse will be effective immediately upon posting. Material changes will be effective thirty (30) days after posting, or such earlier date as may be required by applicable law. This is consistent with the amendment mechanism in Section 17.1 of the Vardera Labs Customer Terms.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.

14. Contact Us

If you have questions or concerns about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us at:

Vardera Labs, Inc. Attn: Privacy Email: info@varderalabs.com

Last Updated: October 6, 2026

© 2026 Vardera Labs, Inc. All rights reserved.