LUASAI SELF-SERVICE PRIVACY NOTICE Version: 1.0-2026-07-12 Effective date: 12 July 2026 This notice explains how Luasai handles personal data when a person visits or uses try.luasai.app, platform.luasai.app, or a related Luasai self-service application (together, the "Platform"). It supplements, and for the Platform is intended to replace, any website-only privacy notice. 1. Who is responsible The data controller is Luasai LLC, a Delaware limited liability company with its address at 1013 Centre Road, Suite 403S, Wilmington, Delaware 19805, USA. Privacy questions and rights requests may be sent to support@luasai.com. If a Company customer separately contracts with Luasai, that agreement may allocate controller and processor roles differently for customer-provided data. 2. Data we collect We may collect: - account data, such as name, work email, business domain, organisation, authentication provider identifiers, role, and account status; - transaction data, such as subscription, credit-pack, invoice, payment status, refund, dispute, and payment-processor customer identifiers. Luasai does not need to store complete payment-card numbers; - product activity, such as searches, selected accounts, reveal actions, credits granted and consumed, saved reveals, feature usage, and support interactions; - device and technical data, such as IP address, browser, operating system, session identifiers, request identifiers, timestamps, and security events; - communications and CRM data, such as signup notifications, sales status, support messages, and consent records; and - information you submit, import, or provide in connection with the Platform. 3. How we use data We use personal data to: - authenticate users and create, administer, and secure accounts; - provide searches, reveals, credits, subscriptions, saved results, support, and other requested Platform functions; - process payments, refunds, disputes, tax records, and billing events; - detect and prevent fraud, chargebacks, account sharing, scraping, abuse, security incidents, and attempts to bypass product controls; - send transactional, security, support, signup, and service communications; - operate sales and customer-relationship processes; - measure reliability and product usage and improve the Platform; - comply with law, enforce agreements, establish or defend legal claims, and protect users, Luasai, and third parties; and - send marketing communications where permitted, with available opt-out rights. 4. Legal bases Where applicable law requires a legal basis, Luasai relies on performance of a contract, legitimate interests in operating and securing a business platform, compliance with legal obligations, protection of legal rights, and consent where consent is required. You may object to processing based on legitimate interests, subject to applicable law and compelling legitimate grounds. 5. Sources We receive data directly from you, your employer or organisation, authentication providers, payment processors, service providers, public and licensed business-information sources, partners, and Platform activity. 6. Sharing We may share personal data with providers supporting identity and access management, hosting and cloud infrastructure, payment processing, analytics, logging and security, communications and support, CRM and sales operations, professional advice, and legal compliance. Current providers may include Google, WorkOS, Stripe, Salesforce, and Slack where those integrations are enabled. We may also disclose data to authorities or other parties where reasonably necessary to comply with law, protect rights and safety, investigate fraud or security incidents, enforce agreements, or complete a financing, merger, reorganisation, or sale subject to appropriate safeguards. Luasai does not sell personal data for money or use personal data for cross-context behavioural advertising. Where applicable law treats an enabled analytics technology as a "sale" or "sharing", you may request the applicable opt-out by contacting support@luasai.com. 7. International transfers Luasai and its providers may process data in countries other than your own. Where required, Luasai will use recognised transfer mechanisms and safeguards, such as adequacy decisions or approved contractual clauses. 8. Retention We retain data only as long as reasonably necessary for the purposes described above. Unless a longer period is required to comply with law, resolve a dispute, enforce an agreement, protect the Platform, or honour credits or saved reveals, our standard retention periods are: - clickwrap evidence, credit ledgers, invoices, refunds, chargebacks, and other contract, tax, and accounting records: seven years; - security, fraud, rate-limit, and suspension records: 24 months; - account, authentication, search, reveal, saved-result, support, Slack, and Salesforce records: while the account is active and for three years after closure; and - deleted data in backups: removed through normal backup rotation within 90 days. 9. Security Luasai uses reasonable administrative, technical, and organisational safeguards designed to protect personal data. These may include access controls, authentication, encryption in transit, logging, monitoring, environment separation, and incident-response procedures. No system is completely secure. 10. Your choices and rights Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or information about processing; object to certain processing; withdraw consent; opt out of marketing; or complain to a regulator. These rights may be subject to legal exceptions, identity verification, and retention obligations. Account closure does not necessarily require deletion of transaction, credit, legal-acceptance, fraud-prevention, security, or dispute records that Luasai must or is permitted to retain. To exercise a right, contact support@luasai.com. We may ask for information reasonably necessary to verify your identity and authority before acting. 11. Cookies and similar technologies The Platform may use strictly necessary cookies or local storage for authentication, security, session continuity, preferences, and load balancing. Analytics or optional technologies must be documented and, where required, presented through an appropriate consent mechanism before activation. 12. Children The Platform is a business service and is not directed to children. Users must be at least 18 years old. 13. Changes We may update this notice. Material changes will be presented through the Platform or another appropriate channel, and the notice will show its current version and effective date. 14. Contact Privacy questions and requests may be sent to support@luasai.com or to Luasai LLC, 1013 Centre Road, Suite 403S, Wilmington, Delaware 19805, USA.