PRIVACY POLICY FOR PET WEARABLE AI HARDWARE

Effective Date: June 1, 2026 Last Updated: June 1, 2026

Auren Innovation Limited ("we," "us," or "Company") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard the information you provide when you access or use our pet wearable AI hardware devices, companion mobile applications, websites, cloud services, and all related services (collectively, the "Services").

This policy is designed to strictly comply with the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the Children's Online Privacy Protection Act (COPPA), and U.S. Executive Order 14117.

1. Our Privacy Principles

Our privacy practices are built upon the following core principles:

• Your Control: You retain control over whether to enable data collection and processing features, and you may manage or delete your data at any time.
• Transparency: We are clear and honest about what information we collect and how it is used.
• Data Minimization: We collect only the information strictly necessary to provide and improve the Services.
• No Advertising Use: We will never use your personal content to serve you targeted advertising.
• No General AI Training: We do not use your personal content to train our generic/foundation AI models.
• Security First: We implement industry-leading security measures to protect your data.

2. Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide Directly

• Account Information: Email address, name, password, and phone number.
• Pet Information: Pet name, breed, age, gender, weight, health conditions, and vaccination records.
• Payment Information: Credit card number, billing address, and transaction history (processed securely by our third-party payment processors).
• Contact Information: Mailing address and phone number.
• User Content: Pet photos, videos, audio recordings, notes, comments, and messages you upload.
• Communications: Records of your correspondence with our customer support team.

2.2 Information Collected Automatically

• Device Information: Hardware model, operating system version, unique device identifiers, IP address, and network connection type.
• Usage Information: Time and date of your visits to the Services, features utilized, clickstream data, and application crash reports.
• Location Information:
• Precise Geolocation Data: Real-time GPS location of the pet wearable device (when location services are enabled).
• Coarse Location Data: General location derived from your IP address.
• Sensor Data: Activity levels, step counts, sleep patterns, heart rate (if applicable), temperature, and other health metrics collected by the wearable device.
• AI Processing Data: Data generated through interactions with AI features, including prompt words, AI responses, and usage statistics.

2.3 Information from Third Parties

• Account authorization information if you choose to log in via Google or Apple.
• Transaction data provided by app stores and payment processors.
• Location-related data provided by mapping service providers.

3. How We Use Your Information

We use your personal information for the following business and commercial purposes:

• Providing the Services: To create and maintain your account, pair and manage devices, provide real-time location tracking, monitor health, and synchronize data.
• AI Functionality: To generate personalized pet stories, memory timelines, health summaries, digital twin experiences, and tailored care recommendations.
• Customer Support: To respond to inquiries, troubleshoot technical issues, and provide general assistance.
• Service Improvement: To analyze usage patterns, test new features, optimize user experience, and fix bugs.
• Security & Fraud Prevention: To protect the Services and users from unauthorized access, fraud, and malicious activity.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Communications: To send you service updates, security alerts, account notifications, and other relevant messages.
• Research & Development: To improve our products and services using purely aggregated and de-identified data.

4. How We Disclose Your Information

We do not sell your personal information.

We only disclose your personal information under the following circumstances:

4.1 Service Providers

We may disclose information to third-party vendors acting on our behalf, including:

• Cloud storage and processing providers
• Payment processors
• Mapping and location service providers
• Customer support platforms
• Analytics providers
• AI infrastructure providers

We strictly require these providers to use your information solely for delivering the requested services and to implement appropriate security measures to protect your data.

4.2 Legal Requirements & Protection

We may disclose your information to:

• Comply with laws, regulations, court orders, or subpoenas.
• Respond to lawful requests from government or law enforcement agencies.
• Protect the rights, property, and safety of the Company, our users, or the public.
• Investigate and prevent fraud, security breaches, or illegal activities.

4.3 Business Transfers

If we are involved in a merger, acquisition, asset sale, or other business transfer, your information may be transferred as part of that transaction. We will notify you before your personal information is transferred and becomes subject to a different privacy policy.

4.4 With Your Consent

We may disclose your information to other third parties when we have your explicit consent to do so.

5. AI Data Processing & Executive Order 14117 Compliance

In strict accordance with U.S. Executive Order 14117 regarding the safe, secure, and trustworthy development of AI systems, we commit to the following:

• We do not use your personal content (including photos, videos, health data, and location data) to train our general-purpose or foundation AI models.
• Our AI systems are improved using only aggregated and fully anonymized data that cannot be linked back to any individual.
• We enforce strict security safeguards to prevent unauthorized access to AI systems and training environments.
• We conduct regular audits to assess the safety, fairness, and reliability of our AI systems.
• We maintain processing logs of AI-generated content to ensure accountability and transparency.

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Account Information: Retained until 30 days after you request account deletion.
• Transaction Records: Retained as required by tax and accounting laws (typically 7 years).
• User Content: Retained until you delete your account or manually delete specific content.
• Location & Health Data: Retained until account deletion, unless a longer retention period is mandated by law.
• Security & Fraud Prevention Data: Retained only as long as strictly necessary for those operational purposes.

Once information is no longer needed, it is securely deleted or permanently anonymized.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in Transit: TLS 1.3 protocol.
• Encryption at Rest: AES-256 standard.
• Strict access controls and multi-factor authentication for internal systems.
• Regular security audits and vulnerability scanning.
• Mandatory security training and background checks for employees.
• Comprehensive data backup and disaster recovery plans.

Note: No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

8. Your Privacy Rights (CCPA / CPRA)

Under the CCPA, as amended by the CPRA, and other applicable laws, you hold the following rights regarding your personal information:

8.1 Right to Know (Access): You have the right to request disclosure of the specific pieces and categories of personal information we have collected about you over the past 12 months.

8.2 Right to Delete: You have the right to request the deletion of your personal information, subject to certain legal exceptions.

8.3 Right to Correct: You have the right to request the correction of inaccurate or incomplete personal information we maintain about you.

8.4 Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit it to another entity.

8.5 Right to Opt-Out of Sale or Sharing: You have the right to direct us not to "sell" or "share" (for cross-context behavioral advertising) your personal information. We do not sell or share your personal information as defined by the CCPA/CPRA.

8.6 Right to Limit Use of Sensitive Personal Information: You have the right to direct us to limit the use and disclosure of your Sensitive Personal Information (e.g., precise geolocation, health data) to exactly what is necessary to perform the Services.

8.7 Right to Non-Discrimination: You have the right to be free from discriminatory treatment for exercising any of your privacy rights.

9. How to Exercise Your Rights

You can submit a verifiable consumer request to exercise your rights via:

• In-App: Navigate to Settings > Data & Privacy.
• Email: Send your request to privacy@auren.pet.
• Mail: Send a written request to FLAT E19, 10/F, NO.52 HUNG TO ROAD, KWUN TONG HONG KONG.

We will respond to verifiable requests within 45 days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing. We may require you to provide additional information to verify your identity before processing your request.

10. Children's Privacy (COPPA Compliance)

Our Services are intended strictly for users aged 13 and older. We do not knowingly collect personal information from children under the age of 13. If we discover that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take immediate steps to permanently delete that information.

If you believe we might have any information from or about a child under 13, please contact us immediately at privacy@auren.pet.

11. International Data Transfers

Your personal information is primarily stored on Amazon Web Services (AWS) servers located in Oregon, United States. We may transfer your information to affiliates and service providers located in other jurisdictions.

When transferring data internationally, we employ appropriate legal safeguards (such as Standard Contractual Clauses) to ensure your personal information remains protected in accordance with applicable data protection laws.

12. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices, policies, or content of these third parties. We strongly encourage you to read the privacy policies of any third-party websites you visit.

13. Additional Disclosures for California Residents

Pursuant to the CCPA/CPRA, we provide the following additional disclosures regarding our data practices over the preceding 12 months:

13.1 Categories of Personal Information Collected

• Identifiers: Email address, name, phone number, mailing address, unique device identifiers, IP address.
• Commercial Information: Transaction records, payment information.
• Internet/Electronic Network Activity: Usage data, clickstream data, device information.
• Geolocation Data: Precise GPS location, coarse location information.
• Sensitive Personal Information: Payment card information, precise geolocation, pet health data.

13.2 Disclosures for a Business Purpose

In the preceding 12 months, we have disclosed the following categories of personal information to the following categories of third parties for business purposes:

• Cloud service providers
• Payment processors
• Mapping and location service providers
• Customer support service providers
• Analytics providers
• AI infrastructure providers

We have not sold any personal information in the preceding 12 months.

13.3 Authorized Agents

You may designate an authorized agent to make a CCPA/CPRA request on your behalf. We will require the authorized agent to provide proof of your written permission and will require you to verify your own identity directly with us.

14. Changes to this Policy

We reserve the right to update this Privacy Policy at our discretion. If we make material changes, we will provide notice by posting the updated policy on our website, updating the "Last Updated" date at the top of this document, and/or sending an in-app notification.

We encourage you to review this Policy periodically. Your continued use of the Services following the posting of changes constitutes your acceptance of such changes.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Email: privacy@auren.pet
• Mailing Address: FLAT E19, 10/F, NO.52 HUNG TO ROAD, KWUN TONG HONG KONG