DataBud Privacy Policy

1. Who We Are

DataBud is owned and operated by Raindrop LLC ("Raindrop," "we," "us," or "our"), a limited liability company registered in Puerto Rico. Raindrop licenses the DataBud platform to commercial partners ("Licensees"), who deploy it in connection with licensed cannabis products in various states. Raindrop — not its Licensees — is the data controller responsible for your information collected through DataBud.ai and any DataBud-powered QR experience.

This Privacy Policy applies to:

• The DataBud.ai website and all DataBud-powered web interfaces
• QR code scan experiences linked from cannabis product packaging
• The DataBud consumer journal and account features
• Any DataBud-hosted sweepstakes, engagement programs, or loyalty mechanics

This Policy does not apply to the cannabis products themselves, which are manufactured and sold by separately licensed cannabis operators. Those operators have their own privacy practices.

2. Age Requirement

DataBud is a platform for adults of legal cannabis consumption age. The minimum age required to use DataBud depends on the laws of the jurisdiction where you reside:

• In the United States, the minimum age is 21 years old in states where adult-use cannabis is legal
• In jurisdictions where medical cannabis use is permitted but adult-use is not, the minimum age is the applicable medical authorization age in that jurisdiction
• In Canada and other jurisdictions, the minimum age is the legal cannabis consumption age where you reside

We require age verification before granting access to any product-related content or experience logging features. If you do not meet the minimum age requirement for your jurisdiction, do not use DataBud. We do not knowingly collect personal information from individuals who do not meet the applicable legal age threshold. If we learn that we have collected data from an underage user, we will delete it promptly.

3. Information We Collect

3.1 Information You Provide Directly

• Account information: name, email address, username, password (if you create an account)
• Profile preferences: communication preferences, notification settings
• Experience logs: Mind, Body, and Mood feedback entries, dose information, timing, setting context, and any free-text notes you submit
• Sweepstakes and engagement entries: name, email, state or jurisdiction of residence, entry timestamps, and any content you upload (e.g., video submissions)

3.2 Information Collected Automatically When You Scan

When you scan a DataBud QR code on a cannabis product, we automatically collect:

• The QR code identifier and associated product and batch information
• The date, time, and general location (country and state/province level, derived from IP address) of the scan
• Device type, operating system, and browser information
• Whether age verification was completed and the method used
• Your session activity within the DataBud experience following the scan

You do not need to create an account for a scan to occur. Anonymous scan data is stored by Raindrop and associated with a device identifier, not your personal identity, unless you choose to link it to an account.

3.3 Experience and Health-Adjacent Data

The core DataBud experience involves you logging how a cannabis product made you feel — across Mind, Body, and Mood dimensions. This information is health-adjacent and may constitute "consumer health data" under applicable privacy laws in some jurisdictions, including the Washington My Health My Data Act.

We collect this data only with your active participation. You choose what to log. Nothing is inferred from passive tracking. We treat all experience log data with the same protections we apply to health data regardless of whether a specific law requires it.

3.4 Wearable and Third-Party Health Data (Optional)

If you choose to connect a wearable device or health platform (such as Apple Health, Oura, or WHOOP), DataBud may receive health metrics you authorize for sharing — such as sleep scores or heart rate data. This connection is entirely optional, always user-initiated, and can be disconnected at any time.

We use this data only to generate observational correlations in your personal history — for example, noting that certain sessions align with certain next-day sleep patterns in your own logged data. We do not use this data for any purpose other than your personal experience and we do not share it.

3.5 Device and Usage Data

• IP address (used for general location inference and security; not stored long-term in identifiable form)
• Browser type, device type, operating system
• Pages visited, features used, time spent
• Cookie and session identifiers (see Section 9)

4. How We Use Your Information

4.1 Providing the DataBud Service

• Matching your scan to the correct product and batch, and displaying the associated lab report and chemistry data
• Receiving and storing your experience logs
• Generating personalized pattern observations based on your own logged history
• Operating your DataBud account and journal
• Administering sweepstakes and engagement programs in which you participate

4.2 Improving the Platform

• Analyzing usage patterns to improve platform performance and user experience
• Training and improving machine learning models that generate personalized pattern insights — using your data only in de-identified or aggregated form for model training that benefits users generally
• Conducting quality assurance and debugging

4.3 Communications

• Sending service-related notifications (account updates, security alerts, changes to this Policy)
• Sending promotional or marketing communications — only if you have opted in, and only through the channels you authorized
• Responding to your questions and support requests

We do not use AI agents, automated callers, or automated text systems to contact you without your express prior consent. Any AI-assisted features within the DataBud platform operate on your data to generate insights for you — they do not contact you through external channels without explicit opt-in.

4.4 Aggregate Analytics and Research

We analyze de-identified, aggregated data across the DataBud user base to generate insights about cannabis product chemistry and consumer-reported outcomes. These aggregate analytics do not identify you individually and are used for:

• Improving DataBud's pattern-matching and recommendation systems
• Generating anonymized industry insights that we may share with or sell to cannabis producers, retailers, researchers, and government entities (see Section 5 for detail)
• Internal research and product development

5. How We Share Your Information

5.1 What We Do Not Do

We do not sell, rent, or trade your personal, identifiable data to any third party. This means we do not share your name, email address, account information, or individual experience logs with anyone outside Raindrop without your consent, except as described in this Section.

5.2 De-Identified Aggregate Analytics — What We Do Sell

Raindrop does commercialize de-identified, aggregate analytics derived from the DataBud user base. These analytics describe patterns across many users and products — for example, which cannabinoid and terpene profiles tend to be associated with certain reported outcomes across thousands of sessions. They cannot identify you or any individual user.

We may sell or license these aggregate analytics to:

• Cannabis producers and brands, to help them understand how their products perform with consumers
• Cannabis retailers and dispensaries, for staff education and product curation
• Academic and commercial researchers studying cannabis effects and consumer behavior
• Government entities and public health organizations

If you are a Washington State resident, see Section 12 for additional disclosure about how this activity interacts with the Washington My Health My Data Act.

5.3 DataBud Licensees

Cannabis producers and brands that deploy DataBud ("Licensees") receive access to aggregate, de-identified reports about consumer engagement with their products through the DataBud producer portal. They do not receive your personal information or individual experience logs. Licensees are contractually prohibited from using DataBud to independently collect, track, or profile individual consumers.

5.4 Service Providers

We share data with trusted third-party vendors who help us operate DataBud — including cloud hosting providers, analytics tools, and communication platforms. These vendors access only the data necessary to perform their services, are bound by confidentiality obligations, and are prohibited from using your data for their own purposes.

5.5 Legal Compliance and Safety

We may disclose information when required by law, regulation, court order, or governmental request, or when we believe disclosure is necessary to protect the rights, safety, or property of DataBud, our users, or the public.

5.6 Business Transfers

If Raindrop is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email or prominent notice on our platform before your data becomes subject to a different privacy policy.

6. Your Consent

By using DataBud, you consent to the collection and use of your information as described in this Policy. Specific consent requirements apply as follows:

• Age verification: you must confirm you meet the legal cannabis consumption age for your jurisdiction before accessing product-related content
• Experience logging: your submission of any Mind, Body, or Mood log is your consent to that data being collected and processed as described in this Policy
• Account creation: creating an account constitutes consent to the collection and storage of your account information
• Marketing communications: separate opt-in required; not implied by account creation or platform use
• Wearable/health data connections: separate opt-in required at the time of connection
• Washington State health data: additional consent requirements apply — see Section 12

You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal. See Section 8 for how to exercise your rights.

7. Data Retention

We retain different categories of data for different periods based on the purpose for which it was collected and our legal obligations:

• Account and profile data: retained for the life of your account and for 3 years after account deletion, or longer if required by law
• Experience logs (identifiable): retained while your account is active; deleted within 60 days of account deletion upon request
• Anonymous session data: retained indefinitely in de-identified form for platform improvement and analytics
• De-identified aggregate analytics: retained indefinitely; these are derived insights, not your personal data
• Sweepstakes entry data: retained for a minimum of 4 years from the close of the applicable sweepstakes, as required by applicable law
• Security and fraud prevention logs: retained for up to 2 years

You may request deletion of your personal data at any time (see Section 8). Deletion requests will be honored within 30 days except where retention is required by law or where data has already been de-identified and incorporated into aggregate analytics, which cannot be individually reversed.

8. Your Rights

You have the following rights regarding your personal data, subject to applicable law in your jurisdiction:

• Access: request a copy of the personal data we hold about you
• Correction: request that we correct inaccurate or incomplete information
• Deletion: request deletion of your personal data, subject to legal retention requirements
• Data portability: request your personal data in a structured, commonly used format
• Opt-out of marketing: unsubscribe from marketing communications at any time
• Withdraw consent: where processing is based on consent, withdraw it at any time
• Restrict processing: request that we limit how we use your data in certain circumstances

To exercise any of these rights, contact us at privacy@databud.ai or by mail at the address in Section 14. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

Washington State residents have additional rights under the My Health My Data Act — see Section 12.

9. Cookies and Tracking Technologies

We use cookies and similar technologies (local storage, session tokens, device identifiers) to:

• Maintain your session and remember your age verification status
• Store anonymous scan history for users who are not logged in
• Analyze how the platform is used and identify performance issues
• Prevent fraud and abuse

We do not use third-party advertising cookies. We do not use tracking pixels or scripts that allow cannabis Licensees to independently track users on DataBud-hosted pages.

You can manage cookie preferences through your browser settings. Disabling cookies may affect the functionality of DataBud, including the ability to maintain anonymous session history.

Specific Cookies We Use

• Age verification cookie: Stores your age verification status to prevent repeated verification prompts (essential)
• Authentication cookies: Maintains your logged-in session securely (essential)
• Session cookies: Tracks your current browsing session (essential)

10. Security

We use industry-standard security measures to protect your data, including encryption in transit (TLS), encryption at rest for sensitive data categories, access controls limiting who within Raindrop can access personal data, and regular security reviews.

Experience log data and health-adjacent data are treated with heightened security controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a security breach occurs that is likely to affect your rights or freedoms, we will notify you as required by applicable law.

11. International Data Transfers

Raindrop is based in Puerto Rico (a U.S. territory). Your data is processed and stored in the United States. If you access DataBud from outside the United States, your data will be transferred to and processed in the U.S., which may have different data protection laws than your home jurisdiction.

Where required by applicable law, we implement appropriate safeguards for international transfers, such as standard contractual clauses. By using DataBud, you acknowledge that your data may be transferred to and processed in the United States.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, the law, or our platform. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy
• Notify registered users by email at least 30 days before the changes take effect
• Display a prominent notice on DataBud.ai for 30 days following a material update

Your continued use of DataBud after the effective date of any update constitutes your acceptance of the revised Policy. If you do not accept the changes, you should stop using DataBud and may request deletion of your data.

14. Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or need to report a privacy concern:

• For Washington State MHMDA rights requests, please use the subject line: "Washington Health Data Rights Request"
• For general privacy questions, use the subject line: "Privacy Policy Inquiry"

We will respond to all privacy inquiries within 30 days.