Budi AI - Privacy Policy

Effective Date: July 28, 2026

Last Modified: July 28, 2026

This Privacy Policy describes how Get Budi Inc., (the "Site", "website", "we", "us", "our" or "Budi") collects, uses, and discloses your personal information when you visit, use our services, make a purchase from https://getbudi.com/, and/or use/engage with our Chatbot or otherwise communicate with us (collectively, the "Services"). For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

Please read this Privacy Policy carefully. By using and accessing any of the Services, including but not limited to engaging with or utilizing our Chatbot, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

We may collect or process the following types of information about you. The specific information we collect about you will vary depending on how you interact with us.

• Contact information and personal identifiers, such as your name, address, email address, telephone number, and username or social media handle

• Device identifiers, such as your MAC address, IP address, or other online identifiers

• Commercial information, such as products or services you have purchased, returned or considered

• Payment information, such as your payment method and payment card information

• Identity verification information, such as photo identification and authentication information

• Online or network activity information, such as your browsing and search history

• Geolocation information, such as information that can help identify your physical location

• Audio and visual information, such as recordings of your voice when you call customer service

• User Content, such as your communications with us and any other content you provide

• Inferences drawn from or created based on any of the information identified above

We also collect statistical or aggregated data and technical information about your internet connection and usage details.

We limit the collection, use, retention, and sharing of personal information to what is reasonably necessary and proportionate to achieve the purposes disclosed in this Privacy Policy.

We may collect personal information about you from various sources:

• Directly from you, such as when you make a purchase, contact us, use our Chatbot, create an account, or participate in a promotion

• When you interact with our website or emails using technologies such as cookies, pixel tags, and similar technologies

• From our business partners and service providers, such as analytics providers, advertising companies, and third party retailers

• From social media platforms and networks, such as Facebook, Instagram, Twitter, Pinterest, and Google

We may combine the information we obtain from the above sources. For example, we may combine information collected through your interactions with the Chatbot on a Host's website with information collected directly through our own website.

We may use the information we have about you:

• To provide the Services to you, including creating and servicing your account, generating product recommendations through the Chatbot, and providing customer support

• To communicate with you and respond to your inquiries

• To administer your participation in special events, contests, surveys or promotions

• For marketing and advertising, such as sending you promotional messages and showing you targeted advertisements

• To operate and understand your use of our websites and applications

• To operate and improve our business, including analytics, quality assurance, research and development

• For legal and security purposes, such as to detect and prevent fraudulent activity and comply with legal requirements

We also may use your information in other ways for which we provide specific notice at the time of collection.

We may share your personal information with:

• Hosts: When you interact with the Chatbot on a Host's website, we share your inputs, product selections, and related data with that Host

• Our Subsidiaries and Affiliates: We may transfer your personal information to our subsidiaries and affiliates on a need-to-know basis

• Service Providers: We may transfer personal information to service providers who perform services on our behalf

• Parties to a corporate transaction: We reserve the right to transfer personal information in the event we sell or transfer all or a portion of our business or assets

• Advertising Companies: We work with third party advertising companies to serve advertisements on our behalf

• Other third parties: We may disclose personal information (i) if required by law or legal process, (ii) to law enforcement authorities, (iii) to prevent physical harm or financial loss, (iv) when required or permitted by law, or (v) with your consent

Data Subject Rights: Depending on local laws, you may have rights with respect to your personal information, including the right to request access, update, correct, delete, or transmit your personal information to a third-party.

Marketing & Advertising Preferences: You can opt-out of receiving marketing communications by following the unsubscribe instructions sent within our communications.

Mobile Device & Browser Preferences: Depending on your device or browser, you may edit your preferences using the settings on your device.

Cookie Preferences: You can choose how certain cookies are used by editing your browser settings or selecting "Manage Cookies" or "Do Not Sell or Share My Personal Information" links on our websites.

Like many websites, we use Cookies on our Site. Cookies are small text files that websites place on your Internet-connected device to uniquely identify your browser or to store information or settings. We use different types of cookies including strictly necessary cookies, performance cookies, functional cookies and targeting cookies.

You can edit your cookie preferences by editing your browser settings. Please note that your settings only apply to the browser you use to submit your opt-out request, so if you use multiple browsers or devices, you must opt-out on each.

Our websites are not designed to respond to "do not track" signals from browsers.

The Services may enable you to post product reviews and other user-generated content. If you choose to submit user generated content to any public area of the Services, this content will be public and accessible by anyone.

We do not control who will have access to the information that you choose to make available to others, and cannot ensure that parties who have access to such information will respect your privacy or keep it secure.

We may use, disclose or otherwise process your personal information to advertise our products and services, including targeted advertising. We work with third party advertising companies to serve advertisements on our behalf.

You can opt-out of cookie-based advertising by editing your cookie preferences as described in the How We Use Cookies section. Please note that even if you opt-out, you may still see ads from us, but they will not be targeted based on your browsing activity.

We are headquartered in the United States and may share your information with service providers and other recipients in the United States and worldwide. If you are located in a region with laws governing data collection and use that may differ from U.S. law, please note that we may transfer personal data to a country and jurisdiction that does not have the same data protection laws as your jurisdiction.

We implement and maintain a comprehensive written information security program ("WISP") that includes administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, acquisition, destruction, use, modification, or disclosure.

Our security measures include: (i) access controls and authentication mechanisms; (ii) encryption of personal information in transit and at rest where appropriate; (iii) network security controls including firewalls and intrusion detection; (iv) regular monitoring, testing, and evaluation of safeguards; and (v) incident response procedures.

For purposes of California Civil Code §1798.81.5 and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), we maintain reasonable security procedures and practices appropriate to the nature of the personal information collected.

There are many factors that we use to determine how long personal information is retained, such as:

• The purposes for which the personal information was collected

• Your marketing preferences and engagement with our Hosts

• Any legal or regulatory requirements that apply

• Whether the personal information may be relevant to protecting our own rights

• Upon receipt of a verified user's request to delete personal information, unless retention is required or permitted by applicable law

Our Services are not designed or intended to collect, store, transmit, or manage Protected Health Information ("PHI") as defined by the Health Insurance Portability and Accountability Act ("HIPAA"). Get Budi Inc. is not a healthcare provider, health plan, or healthcare clearinghouse, and nothing on the Site or in the Services constitutes medical advice, diagnosis, or treatment.

The Chatbot is designed to assist users in discovering cannabis products based on their stated preferences and goals. Any product information, recommendations, or guidance provided is for informational purposes only and should not be relied upon as a substitute for consultation with a qualified healthcare professional.

You must not submit, upload, or transmit any Protected Health Information through the Site or Services. Get Budi Inc. expressly disclaims any representation or warranty regarding HIPAA compliance.

You acknowledge that cannabis products may interact with medications or pre-existing health conditions, and you are solely responsible for consulting a qualified healthcare professional before making any cannabis-related decisions.

The Services are intended solely for individuals who are at least 21 years of age, or the age of majority required to lawfully purchase cannabis products in their jurisdiction, whichever is greater. The Services are not directed to minors, and we do not knowingly collect personal information from any individual under 21 years of age.

As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) the personal information of individuals under 16 years of age.

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide the Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies.

As part of our Services, we use an AI-powered chatbot to provide product recommendations and guidance. To improve the accuracy and performance of our AI systems, we may use data collected through your interactions with the Chatbot — including your inputs, prompts, and conversation history — to train, fine-tune, test, and otherwise improve our artificial intelligence and machine learning models.

We treat conversation data used for AI training in accordance with the data handling practices described in this Privacy Policy. Where required by applicable law, we anonymize or de-identify personal information before using it for model training purposes.

By using the Services, you grant Get Budi Inc. a perpetual, royalty-free license to use your anonymized interaction data for the purpose of improving and developing our AI systems, consistent with applicable law and this Privacy Policy.

In the event of a security breach involving personal information (as defined under applicable law), we will notify affected individuals and relevant regulators without unreasonable delay and in compliance with all applicable state, federal, and other laws.

This includes, but is not limited to, California Civil Code §§ 1798.82 and 1798.150, as well as similar requirements in other U.S. states.

We take data security seriously and maintain reasonable technical, administrative, and physical safeguards appropriate to the nature of the information we handle. However, no method of transmission over the internet or electronic storage is 100% secure.

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information:

• Right to Access / Know: Request access to personal information that we hold about you

• Right to Delete: Request that we delete personal information we maintain about you

• Right to Correct: Request that we correct inaccurate personal information

• Right of Portability: Receive a copy of the personal information we hold about you

• Restriction of Processing: Ask us to stop or restrict our processing of personal information

• Withdrawal of Consent: Withdraw consent where we rely on consent to process your information

• Appeal: Appeal our decision if we decline to process your request

• Managing Communication Preferences: Opt out of receiving promotional emails

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before providing a substantive response to your request.

We reserve the right to revise this Privacy Policy from time to time. We will post changes on this page and indicate the "Effective Date" at the top of this page. Please check back often for any updates.

You acknowledge and agree that it is your responsibility to review this Privacy Policy periodically and that your continued use of our Services after any change will constitute your acceptance of such change.

We will notify you of changes by updating the "Last Modified" date and posting the updated policy on the Site. We may email or otherwise communicate reminders about this policy.

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response, you may have the right to lodge your complaint with your local data protection authority.

This section applies solely to California residents and supplements our Privacy Policy above.

Collection and Disclosure of Personal Information:

We may collect and disclose the following categories of personal information: Contact information and personal identifiers, Device identifiers, Commercial information, Payment information, Identity verification information, Online or network activity information, Geolocation information, Audio and visual information, User Content, and Inferences.

We may disclose this information to: Our Hosts, Our Subsidiaries and Affiliates, Service Providers, fraud detection providers, and law enforcement authorities where required or permitted by law.

Collection and Use of Sensitive Personal Information:

We may collect certain categories that may be considered "sensitive personal information" under California law, such as health and wellness information you voluntarily share in connection with your cannabis product preferences.

Sale or Sharing of Personal Information:

We do not sell or share your personal information for monetary consideration. Certain advertising practices may be considered a "sale" under California law. We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

Your Rights:

If you are a California resident, you have the right to:

• Request access to the personal information we have collected, used, disclosed, and sold or shared

• Request deletion of personal information (subject to certain exceptions)

• Request correction of inaccurate personal information

• Limit our use of sensitive personal information

• Opt-out of the sale or sharing of your personal information

To exercise your rights, contact us at privacy@getbudi.com. We will not discriminate against you for exercising your California privacy rights.

This section applies solely to Colorado, Connecticut, and Virginia residents and supplements our Privacy Policy above.

If you are a resident of these states, you have the right to:

• Request access to, or correction or deletion of, your personal information

• Opt out of the processing of your personal information for targeted advertising purposes or the sale of your personal information

You can exercise your privacy rights by contacting privacy@getbudi.com. You may appeal our decision with respect to a request you have submitted by contacting us at privacy@getbudi.com.

This section applies solely to Illinois residents and supplements our Privacy Policy above.

Get Budi Inc. does not collect biometric identifiers or biometric information as defined under the Illinois Biometric Information Privacy Act (740 ILCS 14) ("BIPA"), including but not limited to fingerprints, retina or iris scans, voiceprints, or facial geometry.

If our data collection practices change in the future to include any such information, we will update this Privacy Policy and comply with all applicable requirements under BIPA prior to collecting any such data.

This section applies solely to Utah residents and supplements our Privacy Policy above.

If you are a Utah resident, you have the right to:

• Request access to your personal information

• Request the deletion of personal information you have provided to us

• Opt-out of the processing of your sensitive information

• Opt out of the processing of your personal information for targeted advertising or the sale of your personal information

You can exercise your privacy rights by contacting us at privacy@getbudi.com.

If you are a Florida resident, you may have rights under the Florida Digital Bill of Rights, including the right to confirm and access the personal information we process, to correct inaccuracies, to request deletion, to obtain a portable copy, and to opt out of processing for targeted advertising or sale of personal information.

To exercise these rights, contact us at privacy@getbudi.com. You may appeal a decision regarding your request by replying directly to our response.

Budi is based in the United States. We make no claims that the website or any of its content is accessible or appropriate outside of the United States. However, as a courtesy to Users in the European Economic Area (EEA), we comply with GDPR requirements.

If you are a resident of the EEA, you have the following data protection rights:

• The right to access, update or delete your information

• The right of rectification

• The right to object

• The right of restriction

• The right to data portability

• The right to withdraw consent

To exercise these rights, contact our privacy team at privacy@getbudi.com.

Users who are residents of the European Economic Area (EEA) may make subject access requests ("SARs") at any time to find out more about the Personal Information which the Company holds about them.

SARs should be addressed to privacy@getbudi.com. Responses to SARs shall normally be made within one month of receipt, however this may be extended by up to two months if the SAR is complex or numerous requests are made.

The Company does not charge a fee for handling normal SARs. We reserve the right to charge reasonable fees for additional copies or requests that are manifestly unfounded or excessive.

All Personal Information breaches must be reported immediately to the Company's designated privacy contact.

If a Personal Information breach occurs that is likely to result in a risk to the rights and freedoms of Users, the Company will ensure that the competent supervisory authority in the relevant EEA Member State is notified without undue delay, and in any event within 72 hours.

In the event of a high-risk breach, affected Users will be informed directly and without undue delay. Data breach notifications shall include: the categories and approximate number of Users concerned, the likely consequences, and details of measures taken to address the breach.

The GDPR requires that processing of Personal Information be lawful. Processing is lawful if at least one of the following applies:

• The User has given consent

• The processing is necessary for contract performance

• The processing is necessary for legal compliance

• The processing is necessary to protect vital interests

• The processing is necessary for public interest

• The processing is necessary for legitimate interests pursued by the data controller

For "sensitive Personal Information," additional conditions must be met, such as explicit consent or processing necessary for health or social care purposes.

If you are a resident of the EEA, you have the right to request that the Company erases the Personal Information it holds about you in certain circumstances:

• It is no longer necessary for the original purpose

• You wish to withdraw consent

• You object to the processing

• The Personal Information has been processed unlawfully

• Erasure is required to comply with a legal obligation

All requests for erasure shall be complied with within one month of receipt, extendable by up to two months for complex requests.

Users in the EEA have the right to require the Company to rectify any Personal Information that is inaccurate or incomplete.

The Company shall rectify the Personal Information and inform the User within one month, extendable by up to two months for complex requests.

If affected Personal Information has been disclosed to third parties, those parties shall be informed of any rectification.

Please contact us with any questions or comments about this Privacy Policy at:

Get Budi Inc.

5227 North 7th Street STE 24542

Phoenix, AZ, 85014 US

For privacy-related matters (including requests regarding your personal information, data rights, or questions about our Privacy Policy):

Email: privacy@getbudi.com

For security inquiries and vulnerability reports:

Email: security@getbudi.com