Yinbo Intelligent Technology (shenzhen) Co., Ltd, a company registered in Shenzhen, People's Republic of China, trading as Intiwave ("Intiwave", "we", "us", or "our"), is the data controller for the personal data described in this Policy and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (intiwave.com), use our mobile application, or interact with our products and services. This Policy applies to all users worldwide and addresses specific regulatory requirements including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA), the Virginia Consumer Data Protection Act (VCDPA), and other applicable data protection laws.

We may collect the following types of information: **Account Information**: Email address (or alias), password hash, and optional display name when you create an account. We do not require your real name. **Waitlist & Newsletter Email**: Your email address when you join our launch waitlist, subscribe to our newsletter, request a referral link, apply to our partner programme, or ask to be notified when in-app subscriptions open. You do not need an account to do any of these. Alongside the address we record the language and country your request came from, which page or app screen you signed up on, the wording of the notice shown to you when you submitted it, and the date and time. If you reached us through a partner's referral link or an advertisement, we also record which one — a referral code, or a short campaign label such as "instagram" — so that we know which channels reach people and can credit the partner who referred you. Nothing about how you use the app or the device is part of this; see our Cookie Policy for how that label is stored and how to prevent it. Partner applications also include the name, website, and description you type into that form. We use all of this only to tell you when we launch and to send the updates you asked for. **Purchase Information**: Shipping address, phone number, and order details when you make a purchase. Payment card details are processed exclusively by our third-party payment processors and are never stored on our servers. **Listening Activity (stays on your phone)**: What you play, how far you get, what you save, your favorites, your intensity settings and your emergency stops are stored on your phone and are not sent to us. The app uses them on your phone to order the home screen and to resume where you left off. If you back up your phone with iCloud or Google, that backup may include this app data; it is handled by Apple or Google under your backup settings, and we cannot read it. See Section 3. **Product Usage Counts (not collected today)**: The current app does not send usage counts. If we add them, they will be counts of in-app events, such as whether a sign-in or a device connection succeeded, with anything that could identify a track, story, tag or mood removed first; they will be off by default behind a Usage analytics switch in Settings, and we will update this policy before they start. **Device & Connection Data**: Device type, operating system version and Bluetooth connection status. When you pair an Intiwave product, the identifier it broadcasts (for example "IW-1A2B3C4D") is sent to our servers together with your account, so that the membership included with a device is granted once per device and cannot be claimed again; when the app checks for a firmware update it also sends the device identifier and firmware version. The name you give your device and its connection history stay on your phone. **Content Delivery Data**: When you play a track from the Intiwave library, the app asks our servers for a short-lived link to that track using your account, so our servers know which track was requested. The audio and its haptic file are delivered through our content delivery network and may be kept on your phone for up to 7 days so that playback is smooth. **Subscription Data**: If you subscribe in the app, Apple or Google handles the payment. Our subscription provider receives your account identifier and the status of your subscription (for example active, renewed, cancelled or refunded) so that we can unlock what you paid for. We never receive your card details. **Crash & Diagnostic Data**: When the app crashes or hits an error, we receive a report of what went wrong: the error and its stack trace, the app version and build number, the device model and operating system version, and a short trail of the preceding in-app events — which screens opened, whether a device was connected, whether a download failed. A sampled share of sessions also sends performance timings, such as how long the app took to start and whether it dropped frames, so that we can find what makes it slow. Before any of this leaves your phone it passes through a filter that strips personal identifiers and every reference to the specific content you were playing; what remains describes how our software behaved, not what you did with it. This runs from the moment the app starts, including on a first launch — a crash on first launch is the one we most need to see, and it happens before any prompt could be answered. Section 5 names who processes these reports and Section 8 states the legal basis we rely on.

**Important Notice**: Given the nature of our products, certain usage data — such as device activation frequency, session duration, and content category preferences — may be considered data concerning your "sex life" under the GDPR (Article 9), "sensitive personal information" under the CCPA/CPRA, or "reproductive and sexual health data" under the VCDPA. **How we handle this data**: • **On your phone**: Audio synchronization and real-time device control run on your phone. For music you import and for Live mode, the conversion from sound to touch also runs on your phone; for our own library, the touch is made in advance from the master recording and delivered with the track. In Live mode, microphone audio is analyzed in memory and is never recorded, stored or uploaded. Music you import into the app stays on your phone and is never uploaded. • **What you listen to stays on your phone**: We do not collect which content you see, open or finish, how long you play, or the intensity settings you use. The only content-related request your phone makes is the short-lived playback link described in Section 2, which our servers need in order to check that you may play the track; we do not keep a listening history from these requests or use them to build a profile of you. • **Explicit consent for product counts**: The app does not send Product Usage Counts today. If we add them, they will stay off until you turn them on, and turning them off, or turning on incognito mode, will stop them immediately. • **Crash reports are the one exception, and they are not analytics**: The diagnostic reports described in Section 2 are sent without a prompt, because a crash on first launch happens before any prompt can be answered. They are scrubbed of personal identifiers and of any reference to the content you were playing, so they cannot describe your preferences, your sessions, or your device settings — only the software fault itself. We rely on legitimate interests for them (Section 8), not on your consent, and we do not use them for analytics, personalization, or profiling. • **Personalization happens on your phone**: The home screen is ordered on your phone from your own history and favorites. Our servers return the same non-personalized order to everyone. We never use any of the data in this policy for advertising, never sell or share it, and never use it to make decisions with legal or similarly significant effects on you. • **Removing what is on your phone**: Incognito mode (Profile → Settings) keeps session history and playback position off your phone while it is on. Uninstalling the app deletes everything it stored on your phone, apart from any copy in a phone backup you made with Apple or Google. • **Deleting your account**: In the app, go to Profile → Legal & data → Delete account. This deletes your account and the data on our servers linked to it immediately, and the app confirms it on screen. Order records are kept for 7 years for tax purposes, and a paired device keeps a record that its included membership was used, with no link to you. Copies in our database backups expire on their own within 30 days, and if your address is on our email list we ask our email provider to delete it within 30 days. Deleting your account does not cancel an App Store or Google Play subscription — cancel that in your store account. You do not need to email us, although you can. • **Washington residents**: Our Consumer Health Data Privacy Policy describes the same practices in the form required by Washington's My Health My Data Act.

We use the information we collect to: • Provide, operate, and maintain our products and services • Process transactions and send order-related communications • Send promotional communications (only with your opt-in consent) • Improve the product through product usage counts, if we add them (only with your consent) • Order the home screen on your phone from your local history and favorites. Recommendations are rule-based; we do not use machine-learning models or third-party AI services to make them • Comply with legal obligations • Protect against fraudulent or unauthorized activity • Respond to your support requests

We do not sell your personal information to third parties. We will never sell data concerning your sex life or sexual health. We may share limited information with: • **Payment processors** — Stripe, Inc. for orders on our website, and Apple or Google for subscriptions bought in the app — to process transactions. They receive only the data necessary to complete your purchase. • **Subscription management** — we use RevenueCat, Inc. (United States) to keep track of in-app subscriptions bought through Apple or Google. RevenueCat receives your account identifier and your subscription status and purchase history; it does not receive your email address, what you listen to, or how you use your device. • **Email service provider** — we use Klaviyo, Inc. (United States) to hold our waitlist and newsletter list and to send those emails. Klaviyo receives your email address and the signup details listed under "Waitlist & Newsletter Email" in Section 2. Klaviyo processes this data on our instructions only and does not use it for its own purposes. • **Crash & performance diagnostics** — we use Functional Software, Inc. d/b/a Sentry (United States) to receive the crash and diagnostic reports described in Section 2. Sentry receives no email address, no account identifier, and no reference to the content you played; it receives the software fault, the app and device version, and the sampled performance timings. Sentry processes this data on our instructions only and does not use it for its own purposes. • **Shipping partners** — name and address only, to deliver hardware orders. Shipments use discreet packaging with no product descriptions visible. • **Infrastructure providers** — we use Supabase, Inc. (United States) to host our account, membership and order databases and our server functions, and Cloudflare, Inc. (United States) to store and deliver library audio and haptic files. They hold this data encrypted on our instructions only. • **Legal authorities** — only when required by law, court order, or to protect vital interests. **Where this data goes**: Our email service provider stores its data in the United States, so if you are in the EEA, UK, or Switzerland, joining the waitlist or the newsletter means your email address is transferred outside your country. That transfer relies on the safeguards described in Section 13. Some of our other providers are also outside the EEA; the same safeguards apply. All third-party service providers are bound by Data Processing Agreements (DPAs) and are prohibited from using your data for their own purposes.

We protect your data with: • **In transit**: TLS 1.2 or later for all web and API communications • **At rest**: AES-256 encryption of server-side storage by our infrastructure providers • **Bluetooth**: Encrypted BLE connections using Secure Connections (LE Secure Connections with AES-CCM) • **Client-side**: Sensitive tokens stored in iOS Keychain / Android Keystore • **Authentication**: bcrypt password hashing No method of transmission over the Internet is 100% secure. If you become aware of any security incident, please contact security@intiwave.com immediately.

We retain your data only as long as necessary: • **Account data**: Retained while your account is active; deleted as soon as you delete your account in the app (backup copies expire within 30 days). • **Purchase records**: Retained for 7 years for tax and legal compliance. • **Usage analytics**: Not collected today; if added, retained for 24 months, then permanently anonymized. • **Crash & diagnostic reports**: Retained for 90 days by our diagnostics provider, then deleted. • **Support communications**: Retained for 3 years after resolution. • **Marketing consent records**: Retained for the duration of consent plus 3 years. • **Waitlist & newsletter entries**: Retained until you unsubscribe or ask us to delete the entry, and in any case no longer than 24 months after your most recent interaction with us if by then you have not created an account or placed an order. You may request earlier deletion at any time (see "Your Rights" below). For a waitlist or newsletter entry you do not need an account: email privacy@intiwave.com from the address you signed up with, or use the unsubscribe link in any email we send you.

If you are located in the European Economic Area, UK, or Switzerland, you have the following rights under the GDPR: • **Right of Access** (Art. 15): Obtain a copy of all personal data we hold about you. • **Right to Rectification** (Art. 16): Correct inaccurate or incomplete data. • **Right to Erasure** (Art. 17): Request deletion of your personal data ("right to be forgotten"). • **Right to Restrict Processing** (Art. 18): Limit how we process your data in certain circumstances. • **Right to Data Portability** (Art. 20): Receive your data in a structured, machine-readable format. • **Right to Object** (Art. 21): Object to processing based on legitimate interests. • **Right to Withdraw Consent**: Withdraw consent for sensitive data processing at any time without affecting the lawfulness of prior processing. • **Right to Lodge a Complaint**: File a complaint with your local Data Protection Authority. **Legal Bases**: We process personal data under: (a) your explicit consent (sensitive data), (b) contract performance (purchases, account), (c) legitimate interests (security, fraud prevention, and keeping the app stable — this is the basis for the scrubbed crash and diagnostic reports described in Section 2, which you may object to under Art. 21), and (d) legal obligations (tax records). To exercise any right, contact privacy@intiwave.com. We will respond within 30 days.

If you are a California resident, you have the following rights: • **Right to Know**: Request details about the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the third parties with whom we share it. • **Right to Delete**: Request deletion of your personal information. • **Right to Correct**: Request correction of inaccurate information. • **Right to Limit Use of Sensitive Personal Information**: Direct us to limit our use of sensitive personal information (including data concerning sex life) to what is necessary to perform our services. • **Right to Opt-Out of Sale/Sharing**: We do not sell or share your personal information for cross-context behavioral advertising. • **Right to Non-Discrimination**: We will not discriminate against you for exercising any of these rights. To exercise any right, email privacy@intiwave.com or use the in-app privacy controls. We will respond within 45 days.

If you are a Virginia resident, you have additional rights regarding reproductive and sexual health data under the Virginia Consumer Data Protection Act: • We will not process your reproductive or sexual health data without your specific, informed consent. • You may have additional remedies under Virginia law if your reproductive or sexual health data is processed without your consent. • You may access, correct, delete, or obtain a portable copy of your data. To exercise any right, contact privacy@intiwave.com.

Our website uses essential cookies so that it works, and measures traffic with Plausible, which sets no cookie and reports only aggregate numbers. If you accept our cookie banner, we may also load Google Analytics and the Meta (Facebook) pixel to learn which advertisements bring people to our site. These are third-party tags that set their own cookies and can recognise you across sites. The Meta pixel loads only on our home, about, press, careers, partner and referral pages, and never on product, shop, checkout, guide or blog pages, so it does not learn which products you look at. It never loads for visitors in Washington State. Nothing from inside the app is ever sent to an advertising platform. If you decline or ignore the banner, or your browser sends a Do Not Track or Global Privacy Control signal, none of these tags load. We do not participate in any advertising exchange or data broker network. Our Cookie Policy lists every cookie and how to withdraw your choice.

Our products and services are intended exclusively for adults aged 18 and older. We do not knowingly collect personal information from individuals under 18. If we become aware that we have inadvertently collected information from a minor, we will promptly delete it and terminate the associated account.

Your data may be transferred to and processed in the United States or other countries. For transfers from the EEA/UK, we rely on: • **Standard Contractual Clauses (SCCs)** approved by the European Commission • **UK International Data Transfer Agreement** addendum where applicable We ensure all transfers are subject to appropriate safeguards and that your data receives an equivalent level of protection.

We may update this Privacy Policy from time to time. For material changes, we will notify you via email (if you have an account) and by posting a prominent notice on our website at least 15 days before the changes take effect.

If you have questions about this Privacy Policy or wish to exercise your data rights: **General Privacy**: privacy@intiwave.com **Security Issues**: security@intiwave.com **Postal Address**: Yinbo Intelligent Technology (shenzhen) Co., Ltd, 403-B033, Huarong Building, 178 Mintian Road, Fu'an Community, Futian Street, Futian District, Shenzhen, Guangdong 518000, China