DRAFT FOR LAWYER REVIEW

This page is a draft for a lawyer to review. It is not a final privacy policy.

This Privacy Policy explains how Lahboom LLC [exact registered entity name pending completion of California formation — confirm before publishing] ("Lahboom," "we," "us," or "our") collects, uses, shares, and protects information when you use our website and web application at www.lahboom.com (collectively, the "Service"). By using the Service, you agree to the collection and use of information as described in this policy.

This Policy describes our general information practices. It does not replace any separate consent we are required to obtain from you by law — for example, express affirmative consent to automatic-renewal billing terms as described in our Terms and Conditions — which we will request specifically, where required, at the relevant point in the Service.

1. Information We Collect

1.1 Account Information. When you register, we collect your email address, name (if provided), and password (stored in hashed form) to create and authenticate your account.

1.2 Core Product Data. To provide the Service, we store the credit cards you add to your account and the information needed to track their associated benefits and credits, including: the cards and benefit programs you select; records of credits you mark as received, including amounts and dates; the review or usage status of each benefit (e.g., unused, pending, used); and any preferences you set for how benefits are tracked or surfaced to you. We do not collect your full credit or debit card numbers for this purpose — only the card product and issuer information, and the benefit-tracking data described above, that you choose to enter.

1.3 Payment Information. If you subscribe to a paid plan, your payment is processed by our payment processor, Stripe, Inc. We do not collect or store your full payment card number; Stripe handles that data under its own privacy policy and security standards (see https://stripe.com/privacy).

1.4 Usage & Device Data. We use PostHog, our product analytics provider, to automatically collect information about how you use the Service, including pages visited, features used, actions taken, browser type, device type, and an identifier tied to your account or device. We do not currently configure PostHog to derive your approximate location from your IP address; if we enable that in the future, we will update this section. We and PostHog also use cookies and local browser storage to recognize your browser and keep you signed in, as described in Section 4. You can control cookies through your browser settings. [Add any in-product analytics opt-out, if one exists.]

1.5 Information from Service Providers. We use the following providers to operate the Service, each of which processes certain information on our behalf: Supabase (database hosting and authentication); PostHog (product analytics); Stripe (subscription billing and payment processing); Railway (application hosting/infrastructure); Resend (transactional and account-related email); and Intercom (customer support messaging). These providers' roles are described further in Section 3.

1.6 Support Data. If you contact us for support, we collect the content of your messages, any attachments you choose to share, your contact information, and conversation metadata (such as timestamps) through Intercom.

2. How We Use Information

We use the information we collect to:

• Create, authenticate, and maintain your account;

• Operate the core features of the Service (tracking your cards and benefits);

• Process subscription payments and manage billing, trials, and renewals;

• Analyze usage to understand how the Service is used and to improve it;

• Communicate with you about your account, service updates, and (where you've opted in) product news;

• Detect, prevent, and address fraud, abuse, or technical issues;

• Comply with legal obligations.

3. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

3.1 Service Providers. We share information with vendors who help us operate the Service, including:

• Supabase (database hosting and authentication)

• PostHog (product analytics)

• Stripe (subscription billing and payment processing)

• Railway (application hosting/infrastructure)

• Resend (transactional and account-related email)

• Intercom (customer support messaging)

Each provider's role differs, and not every provider acts only as our processor. For example, Stripe processes payment information on our behalf to run the Service, but also independently acts as a controller for certain purposes of its own, such as fraud prevention, regulatory compliance, and improving its own services, under Stripe's own privacy policy (see https://stripe.com/privacy). Supabase, PostHog, Railway, Resend, and Intercom process information on our behalf to help us operate the Service, subject to their own privacy and security practices.

AI Support Tools. We do not currently use Intercom's Fin AI agent or other automated AI tools to process your support messages. If we activate such a tool in the future, we will update this Policy and this Section accordingly.

3.2 Legal Requirements. We may disclose information if required by law, legal process, or to protect the rights, property, or safety of Lahboom, our users, or others.

3.3 Business Transfers. If Lahboom is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy.

4. Cookies and Similar Technologies

We and our analytics provider (PostHog) use cookies and similar technologies to recognize your browser, keep you signed in, and understand how you use the Service. You can control cookies through your browser settings, though disabling them may affect how the Service functions.

5. Data Retention

We retain different categories of information for different periods: account and core product data for as long as your account is active and for up to 90 days afterward to allow account recovery and fraud prevention; analytics data in PostHog for up to 12 months; support communications in Intercom for up to 24 months or as needed to resolve your inquiry; billing records in Stripe for as long as required by applicable tax and accounting law (typically at least 7 years); and backups for up to 30 days after deletion from production systems, after which they are overwritten in the normal backup cycle. (These are reasonable starting defaults; adjust any of these periods as your actual practices firm up.)

6. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including relying on the security practices of Supabase and Stripe. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on where you live, you may have rights to:

• Access, correct, or delete the personal information we hold about you;

• Opt out of certain uses, such as marketing emails (via the unsubscribe link in any email);

• Request a copy of your information in a portable format.

Deletion. When you request deletion under this Section, we delete or anonymize your account and core product data across our systems, including with Supabase, PostHog, Stripe, Railway, Resend, and Intercom, except where we are required to retain certain records (such as billing records) by law. Residual copies may persist briefly in backups until they are overwritten on our normal backup cycle, as described in the Data Retention section above.

Depending on the size and nature of our business at a given time, California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to request deletion; whether the CCPA applies to a particular business depends on statutory thresholds that can change as a company grows. [Have counsel confirm whether the CCPA's thresholds currently apply to Lahboom.] Regardless of strict legal applicability, we aim to honor the requests described in this section for all users. To exercise any of these rights, contact us at hello@lahboom.com.

8. Children's Privacy

Lahboom is intended for adults aged 18 and older who hold credit cards. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will take steps to delete it.

9. International Users

Lahboom is based in the United States. Our service providers — including Supabase, PostHog, Stripe, Railway, Resend, and Intercom — may store or process information in the United States or other countries where they operate; please refer to each provider's own privacy policy for details on their data storage locations and international transfer practices. If you access the Service from outside the United States, your information will be processed as described in this Policy.

10. Third-Party Links

The Service may contain links or references to credit card issuers, merchants, or other third-party sites. This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy policies separately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice, and we will update the "Effective Date" above.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at hello@lahboom.com or visit www.lahboom.com.