Coldcart Privacy Statement

Coldcart, Inc. ("Coldcart," "we," "our," or "us") operates the website coldcart.co (the "Site") and provides cold chain logistics orchestration services, including our Coldcart Rx product line. This privacy statement explains how we collect, use, disclose, and safeguard information when you visit our website, request a demo, or otherwise interact with us as a prospective or current business customer.

This statement does not apply to protected health information (PHI) that Coldcart processes on behalf of healthcare customers under a Business Associate Agreement (BAA) in connection with Coldcart Rx. That information is governed by HIPAA and the applicable BAA, not by this statement.

Apart from the PHI addressed above, when we process personal information on behalf of a business customer in order to provide our logistics services — for example, a shipment recipient's name, delivery address, or phone number — we do so as that customer's service provider, and that customer's own privacy notice governs the collection and use of that information. This statement addresses only information we collect directly through the Site or in our own capacity as a business, such as from visitors, demo requesters, and other business contacts.

Our Site and services are intended for businesses in the United States, and we process information in the United States. If you access the Site from outside the United States, your information will be transferred to and processed in the United States. 1. Information We Collect

Information you provide directly:

• Name, email address, company, job title, and phone number submitted through contact, demo request, or sign-up forms
• Content of messages you send us

Information collected automatically:

• IP address, browser type and version, device information, and referring/exit pages
• Pages visited, links clicked, and time spent on the Site, collected via cookies, pixels, and similar tracking technologies (see Section 3)

We do not knowingly collect sensitive personal information (such as health, financial, or government ID data) through the Site. Please do not submit protected health information (PHI) through the Site. If we receive PHI outside our BAA process, we will safeguard it as required by applicable law and take reasonable steps to delete it or move it into our BAA-governed environment.

Notice at Collection (California and Other State Residents)

This notice applies to all individuals whose personal information we collect through the Site, including individuals who interact with us in a business capacity — state privacy laws do not exempt business contact information. The categories below summarize what we collect, where it comes from, why, who receives it, and how long we keep it.

• Identifiers (name, email, phone, company, job title) — Source: collected directly from you — Purpose: respond to inquiries, schedule demos, provide services — Disclosed to: service providers described in Section 4 — Retention: [insert period]
• Internet or network activity (IP address, browsing activity, cookies) — Source: collected automatically — Purpose: Site operation, analytics, marketing — Disclosed to: analytics and marketing service providers — Retention: [insert period]
• Commercial information (messages, inquiries, demo requests) — Source: collected directly from you — Purpose: respond to inquiries — Disclosed to: internal teams and CRM providers — Retention: [insert period]

2. How We Use Your Information

We use the information we collect to:

• Operate, maintain, secure, and improve the Site and our services
• Respond to inquiries, schedule demos, and send you information you request
• Send marketing communications, where permitted, which you may opt out of at any time
• Analyze Site traffic and usage trends
• Detect, investigate, and prevent fraudulent, unauthorized, or malicious activity
• Comply with legal obligations
• Create aggregated or de-identified information that does not identify you, which we use to improve and benchmark our services.

3. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential functions — operating the Site and maintaining security (cannot be disabled)
• Analytics — understanding how visitors use the Site
• Marketing — measuring and delivering relevant marketing

You can control cookies through your browser settings. Disabling certain cookies may limit Site functionality. We honor Global Privacy Control (GPC) signals and other legally recognized opt-out preference signals where technically feasible and required by law.

4. Data Sharing and Third Parties

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, each as those terms are defined under applicable state privacy laws.

We share information with service providers who process it on our behalf and under contractual confidentiality and use restrictions including:

• Hosting and infrastructure providers
• Analytics providers
• CRM, marketing automation, and email delivery tools
• Customer support and communication tools

We also share information with carriers and logistics partners as needed to fulfill shipments; they use it under their own terms and privacy policies. We may also share information with our professional advisors, such as lawyers, accountants, and auditors, who are bound by confidentiality obligations. We may also disclose information: to comply with a subpoena, court order, or other legal process; to enforce our agreements; or to protect the rights, property, or safety of Coldcart, our users, or others. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this statement or a successor statement, and we will notify you of any material change in how your information is treated, as described in Section 10.

5. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this statement, comply with our legal obligations, resolve disputes, and enforce our agreements, after which it is deleted or de-identified. Retention periods vary by the category of information and the purpose for which it was collected; for example, [insert retention period] for contact and demo-request information and [insert retention period] for Site analytics data. Where we de-identify information rather than delete it, we commit not to attempt to re-identify it except as required or permitted by law.

6. Data Security

We use administrative, technical, and physical safeguards, including encryption in transit, access controls, designed to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Privacy Rights

Depending on your location, you may have the right to:

• Know what personal information we hold about you and request access to it
• Correct inaccurate information
• Delete your personal information
• Opt out of the sale or sharing of personal information and of targeted advertising
• Not be discriminated against for exercising these rights
• Limit the use or disclosure of sensitive personal information
• Request a portable copy of your personal information
• Appeal a denial of a privacy request
• Designate an authorized agent to submit a request on your behalf

These rights are available to residents of California and other states with comprehensive privacy laws, to the extent those laws apply. To exercise these rights, contact us using the information in Section 9. We will verify your request before acting on it and will respond within 45 days of a verifiable request (extendable once by an additional 45 days where permitted by law), or the timeframe otherwise required by applicable law. If we deny your request, you may appeal by contacting us using the information in Section 9.

8. Children's Privacy

The Site is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

9. Contact Us

If you have questions about this privacy statement or wish to exercise your privacy rights, contact us at:

Coldcart, Inc.
3302 Lincoln Ave., #496 Chicago, IL 60657
info@coldcart.co
privacy@coldcart.co (privacy-specific inquiries)
Phone: 1 (888) 460-1875

10. Changes to This Statement

We may update this privacy statement from time to time. We will post the revised version on this page with an updated "Last Updated" date, and for material changes, we will provide additional notice where required by law.

‍