Privacy Policy

1. Purpose and Scope

This Privacy Policy describes how Lapis Labs Inc. ("Lapis," "we" or "our") collects, uses, discloses and retains personal data in connection with its websites, business relationships and services (collectively, the "Services"). It applies to visitors, customer representatives, Authorised Users, prospective customers and individuals who communicate with us.

Where we process personal data on behalf of a business customer, the applicable agreement and that customer's lawful instructions govern our role. That customer is responsible for its own notices and lawful grounds for processing. Individuals whose data is processed on a customer's behalf should ordinarily direct requests to that customer; we assist as required by the applicable agreement and law. This Policy does not replace those notices or govern an independent third party's own practices.

This Policy is a notice of practices. It does not, by itself, constitute consent where applicable law requires separate consent, waive an individual's rights or enlarge the scope of Customer's instructions. Information lawfully maintained in a form that cannot reasonably identify an individual is treated in accordance with applicable law.

Business relationships and different roles. This Policy addresses personal data associated with inquiries, negotiations, authorised access, performance of an engagement, account administration, contractual records and the exercise of legal rights. A person may interact with Lapis in more than one capacity, and different purposes or legal roles may apply to different records about that person. A customer's designation of information or an individual's relationship with a customer does not, by itself, determine Lapis's legal role; applicable law, the actual processing and the relevant agreement govern.

Customer-directed processing. Where a customer determines the purposes for which personal data is provided to Lapis, that customer remains responsible for its lawful instructions, the accuracy and appropriateness of the information it supplies, notices owed to individuals and choices required for the customer's activities. Lapis's obligations when acting on that customer's behalf are determined by the applicable agreement and law. This allocation does not relieve Lapis of duties that apply directly to it.

Relationship to contracts. This Policy does not itself create an order, a data-processing agreement, a service-level commitment, a regional hosting commitment or a right to use the platform. It does not expand the Services or authorise processing prohibited by a controlling agreement or applicable law. Commercial payment, cancellation and access rights are addressed in the applicable contract and Terms and Conditions; privacy rights that cannot lawfully be waived remain effective independently of those commercial provisions.

2. Who We Are

Legal entity: Lapis Labs Inc., a Delaware corporation.

Business address: 2261 Market Street STE 86894, San Francisco CA 94114, United States.

Privacy contact: contact@trylapis.com. Requests may also be sent to the address above. Legal and privacy communications are handled exclusively in writing under Section 18, subject to the exceptions stated there.

Communications through representatives. A customer may designate an administrator, business contact or other representative to communicate about its engagement. We may need to distinguish a request made on behalf of that business from a request made by an individual concerning that individual's own personal data. Providing a business email address or holding an administrative role does not automatically authorise a person to obtain another individual's personal data.

Privacy and legal correspondence. The contact details above may be used for privacy questions, requests and grievances. We may route correspondence according to its substance and the role in which we hold the relevant records. A privacy inquiry does not itself establish an entitlement to an Account, approve a prohibited signup or modify a commercial agreement.

3. Key Concepts

"Personal data" means information that identifies, relates to or can reasonably be linked to an individual, including equivalent terms under applicable privacy law.

"Customer data" means information and materials provided or made available by or on behalf of a business customer in connection with the Services. Customer data may include personal data.

"Processing" means operations performed on personal data, including collection, use, storage, disclosure and deletion. References to a controller, processor, business or service provider have the meanings assigned by applicable law; our role depends on the activity and applicable agreement.

Information relating to a business. A business name or business record may also contain personal data, such as the identity or contact details of an employee, representative or signatory. Business use does not make all such information exempt from privacy law. Conversely, a record concerning an organisation does not necessarily constitute personal data about every person associated with that organisation.

Aggregated and de-identified information. Information is not treated as outside privacy protections merely because a direct identifier has been removed. The applicable legal standard and the practical ability to identify or link the information to an individual govern. Any use of aggregated or de-identified information remains subject to applicable safeguards, restrictions on re-identification and a controlling agreement.

4. What We Collect

The categories processed depend on the relationship and the Services provided. They may include:

Identifiers and business contact information: name, business email, telephone number, employer, business address, account identifiers, online identifiers and IP address.

Account and access information: authentication and authorisation information, administrator and user details, permissions, preferences and account activity.

Commercial and transaction information: agreements, billing details, payment status and limited payment metadata, purchases, orders, transaction values and related business records.

Customer-provided information: content, files, communications, business materials and personal data that customers lawfully provide or make available in connection with an engagement.

Internet and electronic activity: device and browser information, timestamps, page and referral information, session and interaction records, event records, diagnostic information and service usage.

Approximate location information: country, region or similar location inferred from technical information such as an IP address. This category does not itself describe collection of precise device location.

Inferences and derived information: engagement, interest or other assessments derived from information described above, where relevant to the applicable Services and permitted by law.

Communications and execution records: inquiries, correspondence, support records, preferences, signer name and title, electronic signatures and related execution and verification records.

Customer shall not provide specially regulated or sensitive personal information beyond the agreed scope without the written arrangements required by law. This restriction does not imply that ordinary account credentials or other information cannot be classified as sensitive under a particular statute.

Context and limits. Not every category is collected in every interaction, and the amount and nature of information depend on what an individual or customer provides, the engagement, permissions granted and the interaction involved. Providing optional information may increase the information processed. The categories above describe personal data, not a representation that Lapis obtains every example from every individual.

Information about other people. Customer-provided materials may include information about employees, representatives, contacts, customers or other individuals. Before providing such information, the person or customer supplying it must have authority to do so and must provide any required notice and obtain any required permission. Unsolicited provision of information does not establish that it is necessary, lawful or within the agreed scope of an engagement.

Restricted and unnecessary information. Do not send government identification numbers, health records, precise location, biometric identifiers, information about criminal offences or other specially regulated information unless its provision has been expressly agreed and all applicable legal requirements are satisfied. Do not include passwords, complete payment credentials or unrelated sensitive information in a general inquiry. These instructions do not override a legally required disclosure or redefine information classified as sensitive by law.

5. How We Collect It

Directly from individuals and customers through correspondence, forms, account administration, agreements and information provided for an engagement.

Automatically when individuals interact with relevant websites or Services, through technical records and similar technologies described in Section 8.

From authorised sources, including customers, their representatives, service providers, business counterparties and publicly available sources where lawful.

By derivation from the information described above, consistent with the applicable purpose, customer instructions and law.

Customer and representative sources. Information may be provided by an individual directly or by the organisation for which that individual works or acts. For example, an administrator may provide a representative's contact details, an authorised signatory may supply execution information, or a customer may include records concerning other individuals in material lawfully provided for an engagement. A person's removal from a business role does not itself require deletion of records the business or Lapis must lawfully retain.

Changes and corrections. Individuals and customers should provide accurate information and inform the appropriate contact of relevant changes. Correcting an account detail may not alter a historical contract, invoice, security record or record maintained by an independent recipient. Requests to correct personal data are handled under Section 13 and applicable law rather than by treating every historical record as if it had never existed.

6. Why We Process Personal Data

We process personal data as applicable to: establish and administer customer relationships and access; perform contracted Services and lawful customer instructions; communicate with customers and respond to requests; prepare agreements, verify authority, issue invoices and maintain payment and transaction records; measure use, interactions and results relevant to the engagement; maintain, troubleshoot, secure and improve the Services within lawful and contractual limits; send permitted business communications; prevent fraud, abuse and unauthorised activity; and comply with law, maintain records and establish, exercise or defend legal claims.

Where we act on a customer's behalf, processing remains subject to the applicable agreement. A customer's provision of information does not, by itself, authorise unrelated use of identifiable customer data or confidential materials. Any additional development or promotional use requires an appropriate lawful basis and any required contractual authorisation. We may use aggregated or de-identified information where permitted by law and the applicable agreement, subject to safeguards against re-identification.

Performance and administration. Subject to the applicable legal basis and our role, processing for a business relationship may include confirming a representative's authority, managing permissions, recording instructions and approvals, responding to an inquiry, reconciling payments, documenting performance, investigating a reported problem and maintaining records needed to resolve a dispute. The same record may be relevant to more than one compatible purpose, and ending one activity does not necessarily eliminate another lawful reason to retain or use that record.

Security, disputes and compliance. Where lawful and proportionate, information may be used to investigate suspected unauthorised access, misrepresentation, circumvention of eligibility restrictions, fraud, misuse or breach of contract; respond to lawful requests; preserve evidence; assess and defend claims; and comply with legal, accounting, tax or regulatory duties. These purposes are not an authorisation to use information without an applicable lawful basis or contrary to a binding data-processing restriction.

Communications and choices. Opting out of promotional communications does not ordinarily prevent communications necessary to administer a requested engagement, address security or billing, respond to a legal request or honour a privacy choice. A communication preference is applied to its relevant purpose and does not, by itself, cancel a contract or erase information needed to comply with law. Requests for deletion or other privacy rights are assessed separately under Section 13.

7. Legal Grounds (where required)

Where applicable law requires a legal basis, we rely on the basis appropriate to the activity: performance of a contract with an individual or steps requested before entering it; legitimate interests in conducting and protecting our business where recognised by law and balanced against individual rights; consent where required; compliance with a legal obligation; or another basis expressly permitted by applicable law.

When acting as a processor or service provider, we process personal data under the applicable customer's lawful instructions and agreement. We do not treat acceptance of general terms or mere continued use as a substitute for consent where the law requires a separate affirmative choice.

Basis depends on the activity. A business contract with an organisation does not automatically establish contract necessity for every use of personal data about that organisation's employees or other individuals. The basis must be appropriate to the relevant activity, individual and applicable law. A description of legitimate interests is not a claim that such interests override an individual's rights in every circumstance or are a recognised basis in every jurisdiction.

Consent and withdrawal. Where processing relies on consent, the relevant choice must satisfy the requirements of applicable law. Withdrawal applies prospectively and does not make prior lawful processing unlawful. It does not prevent processing supported by a separate lawful basis or retention required by law. If withdrawal prevents a requested activity from lawfully continuing, the activity may need to stop; any commercial consequences remain subject to the applicable contract and mandatory law.

Instructions are not a substitute for lawfulness. A customer is responsible for the lawful basis and permissions required for its instructions. A contractual instruction, general acceptance of these Terms or a third party's representation does not dispense with a legal requirement that applies directly to Lapis.

8. Cookies and Similar Technologies

We and relevant third parties may use cookies, local storage and similar technologies to maintain access and preferences; support security; understand website and service activity; and measure communications, interactions and advertising. Advertising-related technologies may also support promotion or retargeting where enabled and lawful.

The data involved may include online identifiers, IP addresses, device and browser information, page activity and event information. Third parties may collect information about activity over time and across different websites or services where such technologies are enabled.

You may manage cookies using available browser settings and contact contact@trylapis.com to request information about applicable choices or exercise a right described in Section 13. Blocking some technologies may affect functionality. Our websites do not currently respond to ordinary browser "Do Not Track" signals. Such a signal is distinct from a legally recognised opt-out preference signal. Applicable consent and statutory opt-out requirements are not displaced by browser settings or this Policy.

Different purposes. Technologies used to maintain a requested session or protect access may serve a different purpose from technologies used for measurement or promotion. The lawful basis and applicable choice requirements depend on the technology, purpose, information and jurisdiction. This Policy does not describe every technology as essential or treat use of a website as blanket consent to all optional processing.

Scope of browser choices. Browser or device settings may affect future collection or storage on that browser or device without deleting information already lawfully received. Settings may need to be managed separately on different browsers and devices. Removing stored information may remove preferences associated with it. These practical limitations do not displace a duty to provide or honour a legally required consent or opt-out mechanism.

Recipient activity. An independent recipient may associate information it receives with information obtained from other sources in accordance with its own practices and applicable law. Whether a particular disclosure is classified as sale, sharing or targeted advertising depends on the actual disclosure, recipient arrangements and governing law; the absence of a monetary payment does not itself resolve that classification.

9. Sharing and Disclosure

We may disclose personal data within the following recipient categories for the purposes described in this Policy:

Service providers and contractors performing functions on our behalf, subject to applicable contractual restrictions. Depending on their function, they may process contact, account, commercial, customer-provided, electronic-activity, location, derived or communication information necessary for that function.

Customers, their administrators and authorised recipients, where information relates to their engagement or the individual acts on their behalf, subject to permissions and the applicable agreement.

Independent recipients an individual or customer directs us to use, and business counterparties involved in an authorised transaction or activity. Their independent processing is governed by their own applicable notices and obligations.

Advertising and measurement recipients, where relevant technologies are enabled, which may receive identifiers, electronic-activity information and associated interaction or transaction information for measurement or permitted promotion. Some such disclosures may constitute "sale," "sharing" or targeted advertising under applicable privacy law even where no money is exchanged. Applicable choices are described in Sections 8 and 13.

Professional advisers, including legal advisers, auditors and insurers, where needed for advice, compliance or protection of legal interests.

Counterparties and advisers in an actual or proposed financing, reorganisation, merger, acquisition or transfer of assets, subject to appropriate confidentiality and legal requirements.

Authorities and other recipients where disclosure is required or permitted by law, legal process, protection of rights or safety, or prevention and investigation of unlawful activity.

Where we act as a processor or service provider, disclosures of customer personal data remain subject to the applicable agreement and law. Confidentiality does not prevent a disclosure that applicable law requires.

Purpose and capacity of recipients. A recipient's legal role depends on the relevant activity and arrangement. A contractor processing information only on our behalf is distinct from an independent recipient processing for its own purposes. A customer's direction to disclose information to an independent recipient does not give that recipient unrestricted authority to use it or remove duties applicable to either party.

Organisational access. A customer's authorised administrators and representatives may receive information needed to administer the customer's relationship, permissions, instructions, transactions and related business records. Customers are responsible for determining appropriate internal authority and access. An individual's departure, change of role or removal from an Account does not automatically erase historical organisational records or grant the individual control over all records belonging to the business.

Transactions and legal disclosures. A proposed transaction may require limited disclosures for due diligence or professional advice even if the transaction is not completed, subject to applicable confidentiality and data-protection requirements. Legal or protective disclosures may involve responding to legal process, preserving records, preventing fraud or protecting a legal claim. Disclosure may occur without advance notice where permitted or required by law; this does not authorise disregard of a notice or challenge obligation imposed by a controlling agreement or applicable law.

9A. Use of Customer Marks in Marketing

Use of a customer's business name or marks is governed by Section 6A of the Terms and Conditions and any controlling signed agreement. Publication of an individual's identity, testimonial, confidential information or non-public results requires any separate permission or lawful basis applicable to that use.

Business marks and personal data. Permission to identify an organisation as a customer does not automatically permit use of an individual's image, personal endorsement, identity, confidential communication or non-public results. Any use involving personal data remains subject to its applicable lawful basis and required permissions, even where a separate licence permits use of the organisation's marks.

Revocation and existing records. A request about future use of a customer mark is handled under the relevant contractual permission. It does not necessarily require recall of previously distributed materials or deletion of business records that must lawfully be retained. An individual's personal-data request remains independently subject to the rights and exceptions described in Section 13.

10. Cross Border Transfers

Personal data may be processed in the United States and other jurisdictions in which Lapis, authorised personnel or recipients described in Section 9 operate. Applicable legal protections may differ by jurisdiction. Where a transfer is subject to legal restrictions, we use the safeguards or transfer basis required by applicable law and the relevant agreement.

An enterprise engagement may impose additional location or transfer requirements through its applicable agreement. Availability of a website does not, by itself, represent that the Services are offered in every jurisdiction. We do not rely solely on use of a website as consent to a transfer requiring a separate legal basis.

No implied localisation commitment. Location-specific storage, access, residency or transfer requirements must be addressed in a controlling agreement where relevant. A customer's internal policy or unilateral instruction does not, by itself, establish that Lapis has accepted a particular localisation requirement. Applicable legal restrictions remain binding regardless of whether the parties have negotiated additional contractual requirements.

Access and onward disclosure. A transfer question may arise from authorised access as well as storage or disclosure. Relevant safeguards depend on the parties' roles, the destination, the nature of the information and the governing law. The regional exclusion in Section 17A addresses platform eligibility; it is not a statement that privacy law can never apply to information associated with an attempted or prohibited interaction.

11. Information Security

We maintain administrative, technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and loss, taking account of the nature of the information, relevant risks and applicable obligations.

No method of transmission or storage is completely secure, and no absolute security guarantee is made. Individuals and customers should safeguard their credentials and promptly report suspected misuse. This statement does not limit a security, notification or other obligation imposed by applicable law or an express signed agreement.

Allocation of practical responsibilities. Customers and individuals should limit access to authorised persons, protect their own devices and communications, use credentials only as authorised and promptly report suspected compromise. Sharing access, failing to remove a former user's authority or transmitting information to an unintended independent recipient can create risks outside Lapis's control. These responsibilities do not excuse a failure by Lapis to meet a duty imposed on it by applicable law or a signed agreement.

Inquiries and incident-related processing. Information provided in a security report may be processed to assess the report, verify authority, investigate relevant events, communicate with affected counterparties, preserve evidence and comply with legal obligations. A report or inquiry does not, by itself, establish that a breach occurred or create an additional security warranty, certification commitment or obligation to disclose confidential operational records. Required notifications and disclosures remain governed by applicable law and controlling agreements.

12. Data Retention

We retain personal data for as long as reasonably necessary for the purposes for which it is processed, subject to applicable agreements, lawful instructions and legal requirements. Relevant criteria include the duration of the relationship; the nature and sensitivity of the information; the need to perform an engagement, resolve disputes or enforce obligations; applicable tax, accounting and recordkeeping requirements; security and fraud-prevention needs; and available deletion or de-identification methods.

Customer personal data processed on a customer's behalf is returned, deleted or retained in accordance with the applicable agreement and lawful instructions. Retention required by law or a valid legal hold may continue after an engagement ends. Residual backup records may remain until removed through the applicable retention cycle and remain subject to appropriate restrictions.

A marketing opt-out stops the relevant promotional communications; limited suppression information may be retained to honour that choice. Deletion is subject to applicable exceptions and is not a promise to remove records required for legal compliance or preservation of rights.

Different records have different retention needs. Contact details, contract and execution records, invoices, transaction evidence, permission records, security records, correspondence and customer-directed materials may be subject to different retention criteria. The end of an Account or engagement does not necessarily end the need to preserve records for taxation, accounting, fraud prevention, legal proceedings or the establishment and defence of rights. Information is not retained indefinitely merely because such a category of purpose exists; the applicable need, agreement and law govern.

Deletion, restriction and residual records. A deletion request may require removal of particular personal data while allowing or requiring retention of other records. We may need to preserve enough information to document a request, prevent a prohibited re-contact, comply with a legal hold or record a lawful transaction. Where information remains subject to a retention exception, that exception does not authorise unrelated use. Deletion of records controlled by Lapis does not itself erase copies lawfully held by an independent customer or recipient.

No blanket timing promise. This Policy does not establish a single retention period for every category, promise immediate erasure from every backup or override an agreed return or deletion requirement. Applicable legal deadlines and binding contractual commitments remain effective.

13. Your Rights

Depending on applicable law and our role, individuals may have rights to confirm processing and access information; obtain a copy or portable form; correct inaccuracies; request deletion; restrict or object to processing; withdraw consent without affecting prior lawful processing; opt out of sale, sharing or targeted advertising; limit certain uses of sensitive personal data; appeal a decision; and complain to the competent authority. We will not discriminate for exercising a protected right, subject to lawful exceptions.

Statutory Scope; No Voluntary Extension. The rights described in this Section apply only where, and to the extent that, applicable law requires Lapis to recognise them, taking into account Lapis's role and all applicable thresholds, exemptions and limitations. This Policy does not voluntarily extend statutory rights or their related procedures to persons or information outside their legal scope. A paid subscription, payment of an outstanding invoice or creation of an Account is not required to submit a request that Lapis is legally required to honour.

Discretionary Assistance for Paid Customers. Except to the extent required by applicable law or an applicable binding agreement, discretionary account or administrative assistance may be requested only by a current paid customer acting through an authorised account representative. The availability and scope of any such assistance are subject to the customer's applicable agreement and subscription and Lapis's approval. Paid status alone does not create an entitlement to additional services or assistance. Where neither applicable law nor a binding agreement requires action, Lapis may decline an optional request, including a request by a visitor, a former customer or a person without a current paid engagement. This limitation on optional assistance does not restrict a mandatory privacy right or a request Lapis is legally required to address.

Requests may be sent to contact@trylapis.com or the address in Section 18. We may request information reasonably necessary to verify an access, correction or deletion request or an agent's authority. Opt-out requests are not subject to identity verification where prohibited by law. We respond within applicable legal periods and explain any limitation or available appeal process as required.

Applicable law may also permit exercise of an opt-out through a recognised preference signal or require another request method. These rights remain effective whether or not described in this Policy. Where we act for a customer, we may direct a request to that customer and assist it in accordance with law and the applicable agreement.

Scope of a request. Please identify the right you wish to exercise and provide enough information to locate the relevant relationship or interaction without sending unnecessary sensitive information. A request made in a business capacity may require different authority from a request concerning the requester's own personal data. We may ask for clarification where reasonably necessary and permitted by law, but a request does not require an individual to waive a protected right or enter into a new contract.

Verification, agents and protection of others. Verification requirements must be proportionate to the request and permitted by law. An authorised agent may need to establish the authority required for the particular request. We may limit an access or portability response where disclosure would expose another person's protected information, compromise security, reveal legally protected confidential material or violate a recognised legal exception. These limitations do not apply merely because a disclosure would be inconvenient. Opt-out requests are not made subject to identity verification where applicable law prohibits that requirement.

Exceptions, timing and review. A right may be subject to a lawful exception, including retention required by law, protection of legal claims or processing outside the scope of the relevant statute. Where required, we will explain a refusal or limitation and the available appeal or complaint route. Response periods, permitted extensions and any charge for a manifestly unfounded, excessive or repetitive request are governed by applicable law; no fee or delay is imposed merely because a request is adverse to Lapis's commercial interests.

Different choices have different effects. A promotional opt-out, consent withdrawal, access request, deletion request and request to cancel a commercial engagement are separate actions. Exercising one does not automatically exercise all others or erase a valid debt, cancel a binding commitment or require deletion of records that must lawfully be retained. Mandatory rights and remedies remain effective despite that distinction. Where Lapis acts on a customer's behalf, the customer's role in responding does not remove any direct obligation applicable to Lapis.

14. Children's Privacy

The Services are intended for adult business users and are not directed to children. We do not knowingly solicit personal data from individuals under eighteen for their own use of the Services. Customers are responsible for ensuring a lawful basis and any required protections for personal data they provide about others, including minors.

If we learn that personal data has been collected unlawfully from a child, we will take steps required by applicable law, including deletion where required. Concerns may be reported to contact@trylapis.com. This Policy does not authorise processing of children's data that is prohibited by law or outside the applicable agreement.

Information supplied by a business. Customers shall not use the platform to solicit or provide children's personal data in violation of law or outside the agreed scope. A parent's, guardian's or customer's assertion of permission does not dispense with any required verification, notice, consent or protective measure. Eligibility restrictions for the platform remain separate from any lawful handling required if information about a minor is incidentally or improperly provided.

Reports. A person reporting suspected unlawful collection should provide enough information to identify the concern while avoiding unnecessary additional information about the child. Assessment and any action taken remain subject to applicable law, preservation duties and a controlling agreement, rather than a promise that every record associated with the report can immediately be erased.

15. Third-Party Links and Integrations

An individual or customer may direct information to an independently operated website, service or other recipient. The independent recipient's processing is subject to its own privacy practices and applicable obligations. Review those notices and manage permissions with that recipient where relevant.

This distinction does not remove Lapis's responsibilities for its own processing or for service providers acting on its behalf.

To the fullest extent permitted by law, Lapis is not responsible for the independent privacy practices, security or availability of a recipient an individual or customer chooses that acts for its own purposes, and interaction with that recipient is at that individual's or customer's risk. This allocation does not limit Lapis's responsibilities for its own processing, for service providers acting on its behalf, or for any obligation that applicable law does not permit Lapis to exclude.

Directions and withdrawal of permissions. Before directing a disclosure to an independent recipient, individuals and customers should establish that the disclosure is authorised and review the recipient's terms and privacy notice. Revoking a permission may prevent future exchanges without requiring the independent recipient to delete information already lawfully received. Requests concerning that recipient's own processing should be directed to it, without limiting any responsibility Lapis separately has for the disclosure.

No implied endorsement or agency. A reference or connection to an independently operated recipient does not, by itself, make that recipient Lapis's agent, create a joint undertaking or guarantee that recipient's practices. The applicable facts and law determine the relationship; this statement does not reclassify a service provider acting on Lapis's behalf as an independent recipient.

16. Changes to This Policy

We may update this Policy to reflect changes in practices or legal requirements. The published version will state its effective or last-updated date. If a change materially affects existing rights or obligations, we will provide conspicuous notice at least thirty days before it takes effect, unless a different period or procedure is required by law.

A revision does not, by itself, authorise a materially different or incompatible use of previously collected personal data. We will provide any additional notice and obtain any consent required before that use. A Policy update does not amend a signed data-processing agreement except in accordance with its terms.

Prospective changes and existing data. A change to a description, purpose, category of recipient or legal basis must be assessed against the applicable requirements for notice, compatibility and consent. Merely replacing the published text does not create permission for a use prohibited by an existing commitment or law. A required choice cannot be obtained solely by making the new text more detailed or by describing continued use as acceptance.

Contract and notice hierarchy. A contractual amendment and an update to a privacy notice serve different functions. Neither automatically changes the other, and a customer-specific agreement may impose additional notice, authorisation or processing restrictions. Rights that applicable law does not permit the parties to exclude are not displaced by a conflicting contractual or published statement.

17. Region-Specific Provisions

United States. Applicable state privacy laws may grant the rights described in Section 13. Categories of information, sources, purposes and recipients are described in Sections 4 through 9, and retention criteria in Section 12. This Policy does not restrict any additional disclosure or choice required for sale, sharing, targeted advertising or sensitive information under applicable state law. Rights and applicability depend on the relevant law and facts; business contact information is not assumed to be categorically exempt.

India. Requests, corrections, withdrawals of consent and privacy grievances may be submitted to contact@trylapis.com or the address in Section 18. We will handle them in accordance with applicable Indian law. Rights and duties under the Digital Personal Data Protection Act, 2023 and related rules apply to the extent the relevant provisions are in force and applicable to the processing. A request may be identified as an Indian privacy grievance to assist routing. Nothing in this Policy limits a mandatory local notice, consent, grievance or transfer requirement.

Other jurisdictions. Where another jurisdiction's law applies, any mandatory rights, notices, transfer protections and local requirements remain effective. A public notice does not displace those requirements or establish that a particular regional law applies to every engagement.

Application depends on the law and facts. The rights, obligations, exemptions and territorial rules of each applicable law determine which provisions apply to an interaction. A general description in this Policy does not represent that every statute applies to every person, that every processing activity has the same legal role, or that all rights have identical scope and procedures. Applicable regional notice, contact, consent, request-method and transfer requirements remain effective.

No automatic commercial preference. Regional privacy rights are distinct from a negotiated commercial concession. Nothing in this Policy grants preferential pricing, a different service level, a refund, a right to early commercial cancellation or an entitlement to platform access solely because of an individual's location. This statement does not restrict a right or remedy that the applicable law makes mandatory.

17A. European Union Access Restriction

LAPIS IS NOT DESIGNED OR INTENDED FOR USE IN THE EUROPEAN UNION. The platform is not offered or authorised for use within the European Union. All signups originating within the European Union are ineligible and will not be accepted or granted access to the platform. The eligibility restrictions in Section 3A of the Terms and Conditions apply.

We may process information associated with an attempted signup or access, including contact information, IP address, approximate location and technical records, as reasonably necessary to administer eligibility restrictions, prevent circumvention and abuse, protect security, maintain required records and comply with applicable law. An attempted signup or inadvertent access does not establish eligibility or authorise use of the platform.

Nationality, residence or location does not confer any additional contractual entitlement, preferential commercial treatment, warranty, refund, cancellation right or service commitment. This regional exclusion does not displace any non-waivable privacy right or any obligation imposed on Lapis by applicable law. Applicable rights may be exercised using the contact details in Section 18.

Ineligible interactions. Completion of a form, receipt of a message, submission of information, acceptance of a payment or inadvertent creation of an Account does not waive the European Union exclusion or establish an entitlement to platform access. Individuals and customers shall not use false location information, a representative or another method to evade the eligibility restriction described in the Terms and Conditions.

Handling information is not acceptance of an engagement. Responding to an inquiry, privacy request, legal process or security concern arising from the European Union does not, by itself, authorise platform use or approve a signup. Information associated with such an interaction remains subject to any duties imposed by applicable law. The exclusion is an eligibility policy and does not purport to eliminate a mandatory privacy right or to determine territorial legal applicability by contract alone.

18. Contact Information

Privacy requests and questions should be directed to:

Lapis Labs Inc.
2261 Market Street STE 86894
San Francisco CA 94114
United States
contact@trylapis.com

Written Correspondence Only. Except where applicable law requires another method or a controlling signed agreement expressly provides otherwise, Lapis handles legal and privacy inquiries, notices, requests, complaints and related correspondence exclusively in writing through the email or postal contact details provided in this Section. Lapis does not accept or provide phone calls, live voice calls, video calls or voicemail handling for these matters. An oral statement, telephone call, voicemail or request for a callback does not constitute delivery of a contractual notice or require Lapis to respond orally. This correspondence policy does not alter mandatory privacy-request methods, lawful service of process, communications required by a court or regulator, or arbitration and other formal proceedings governed by Section 17 of the Terms and Conditions.

This Policy should be read with the applicable customer agreement and the Lapis Terms and Conditions. Nothing in those Terms waives privacy rights that cannot lawfully be waived.

Information to include. Correspondence should identify the relevant request or concern, the relationship or interaction involved and an appropriate return contact. Do not send passwords, complete payment credentials or unrelated sensitive records in a general privacy inquiry. Additional information may be requested only as reasonably necessary and permitted by law to identify the records, verify relevant authority or respond appropriately.

Record of correspondence. We may retain information about a request and its handling where reasonably necessary to respond, document compliance, honour a continuing preference or establish or defend a legal right, subject to the retention criteria and restrictions described above. A request received through this contact route does not waive Lapis's legal rights, approve a prohibited signup or constitute acceptance of a proposed commercial term.