Privacy Policy

Effective date: November 2, 2026

Who we are

Elf Labs, Inc. ("Elf Labs," "we," "us," or "our") is a Delaware corporation. This Privacy Policy explains how we handle personal information in connection with invest.elflabs.com, including our newsletter, investment inquiry forms, and checkout.

Our mailing address is 1111 Brickell Ave, 10th Floor, Miami, FL 33131. You can contact us about privacy at invest@elflabs.com.

This policy covers our investor website. DealMaker and other websites you visit have their own privacy policies.

Information we collect

Contact and subscription information. When you subscribe to our newsletter, we collect your email address. When you save your details or continue with valid contact details in checkout, we collect your first and last name, email address, phone number, chosen investment amount, calculated total, and the consent wording and time associated with your submission.

Investment information. Our checkout asks whether you are an existing investor; whether you are investing as an individual, jointly, through an entity, or through an IRA; your mailing address; and your accredited-investor status. If you indicate that you are not accredited or are unsure, it also asks for annual income and net worth to calculate an investment limit. The page records your acknowledgements to validate the form. Those acknowledgement answers are not included in the site's submission to DealMaker.

Technical and campaign information. Our hosting and service providers process technical information needed to deliver and protect the site, such as IP address, browser and device information, requested pages, and request times. The site stores campaign information from referring links, such as campaign source, medium, name, content, and search term. When available, a click identifier from our marketing provider is associated with your DealMaker submission to help attribute investment activity to a campaign.

Browser storage. We use session storage to remember campaign information and your position on the page when moving to or returning from checkout. Session storage generally lasts for the browser-tab session. Browser settings and session restoration can affect when it is cleared. If you save your details at checkout, we keep your name, email, phone, address and investment amount in your browser's local storage for up to 30 days.

How we use information

We use personal information to:

• provide the website and respond to questions;
• send requested investor news, company updates, and investment-related communications;
• save submitted contact details and follow up on investment interest;
• calculate investment amounts and limits and transfer submitted details to DealMaker;
• understand campaign referrals and attribute investment activity;
• maintain security, prevent misuse, and troubleshoot technical problems;
• comply with applicable legal obligations and respond to lawful requests.

We use financial information entered in checkout to support the investment process. The site's newsletter submission does not include your annual income or net worth.

Email and phone information

Our newsletter and checkout contact forms submit information to Klaviyo, our email service provider. The checkout stores your phone number as a profile property; it does not subscribe you to text messages. This investor website does not operate an SMS marketing program.

You can unsubscribe from marketing emails using the unsubscribe link in those messages or by contacting invest@elflabs.com. An unsubscribe request does not prevent communications needed to administer an investment or meet legal obligations.

DealMaker and your investment

When you choose to continue to DealMaker, the site sends your submitted information to our server over HTTPS. Our server uses the DealMaker API to create or update the information needed for your investment and obtains a DealMaker access link for you.

The submission includes contact information, investment amount, investor type, address, returning-investor information, accredited-investor information, campaign details, and, where provided and applicable to the investor profile, annual income and net worth. The site does not place those personal details into the query string of a checkout link. A DealMaker access link may contain a private access token and should not be shared.

The website server processes the submission to facilitate the handoff. The current implementation does not create a separate persistent database of these checkout submissions on the website server. Contact and subscription records sent to Klaviyo and investor records held by DealMaker are separate records.

DealMaker handles its identity checks, subscription documents, and payment process. Broker-dealer services are provided by DealMaker Securities LLC, member FINRA/SIPC. Its handling of information is described at https://www.dealmaker.tech/privacy.

How we share information

We disclose information to providers and recipients involved in the purposes described above, including:

• Cloudflare, for website hosting, video delivery, security, and request processing;
• Klaviyo, for contact records, subscriptions, and email services;
• DealMaker, to facilitate your investment;
• Lead Genesis, our marketing provider, for campaign attribution and related marketing services;
• Google, through Google Tag Manager, which the site loads to manage website tags.

We may also disclose information to professional advisers, to comply with applicable law or legal process, to protect rights and safety, or in connection with a merger, acquisition, financing, or transfer of business assets. We may disclose information for other purposes when you authorize us to do so.

We do not sell personal information in exchange for money. Disclosures for targeted advertising can be treated as a sale or sharing under some privacy laws even when no money is exchanged.

Cookies, tags, and advertising choices

The site loads Google Tag Manager and is configured to load Lead Genesis campaign tracking. Campaign identifiers can connect a referral to an investment submission. Google Tag Manager is a tag-management service; its presence alone does not mean that Google Analytics, Google Ads, or Meta Pixel is active.

As of the effective date, the published Google Tag Manager container contains no configured tags. This policy does not represent Google Analytics, Google Ads, or Meta Pixel as active tools on this site. We will update the applicable disclosures and controls before adding new advertising or analytics uses that require them.

You can manage cookies and site storage through your browser settings. Restricting storage or scripts may affect features or campaign attribution. Email unsubscribe choices are managed separately.

The site's current implementation does not provide a cookie-preference panel or a verified automated response to Global Privacy Control. Browser settings alone may not stop all server-side processing. You can contact invest@elflabs.com with questions or requests concerning advertising, tracking, or disclosure of your information. This contact method does not replace any automated opt-out mechanism required by applicable law.

Your privacy rights

Depending on where you live and which laws apply to our processing, you may have rights to request access to or a copy of your personal information, correction, deletion, or portability; to opt out of a sale, sharing, or targeted advertising; or to limit certain uses of sensitive information. These rights may be subject to exceptions, including information needed to comply with securities laws, prevent fraud, or establish or defend legal claims.

The information categories described above include identifiers and contact records, financial and investment information, and technical and internet activity information. We describe their sources, uses, and recipients in the corresponding sections of this policy. Financial details can receive additional protection under applicable laws; we use them for the investment purposes described here.

To make a privacy request, email invest@elflabs.com or write to Elf Labs, Inc., Attn: Privacy Requests, 1111 Brickell Ave, 10th Floor, Miami, FL 33131. Please describe your request and how we can contact you. Do not include passwords, Social Security numbers, payment details, or copies of identity documents in an initial email.

We may ask for information reasonably necessary to verify an access, correction, or deletion request. Where applicable law allows an authorized agent, we may request evidence of the agent's authority. We will handle requests within the periods required by applicable law and explain any permitted extension or denial. If applicable law provides an appeal right, you may appeal by replying to our response or emailing the same address with the subject "Privacy appeal."

We will not unlawfully discriminate against you for exercising privacy rights.

Retention

Retention depends on the type of information and the purpose for which it is held. We consider the duration of our relationship with you, whether an investment or inquiry is ongoing, your marketing preferences, legal and regulatory obligations, security needs, and the time needed to resolve disputes.

• Marketing and contact records: retained to manage subscriptions, respond to inquiries, and maintain the relationship for which they were collected. Unsubscribing stops marketing messages; it does not automatically delete all records. Limited suppression and consent records may be needed to honor your preferences and document them.
• Unfinished investment inquiries: retained according to the status of the inquiry, subsequent communications, and applicable legal or business record requirements. You may request deletion, subject to applicable exceptions.
• Investment and financial information: processed through the website for the DealMaker handoff; records subsequently maintained by DealMaker are subject to its practices and applicable recordkeeping obligations. Any records held by Elf Labs for investment administration are retained according to applicable obligations and legitimate recordkeeping needs.
• Technical and campaign records: retained according to operational, security, attribution, and provider requirements. Browser session storage is described above.

Security

The site uses HTTPS and Cloudflare infrastructure. We use safeguards intended to protect personal information, but no system or method of transmission can be guaranteed completely secure. Keep private investment access links and account credentials confidential.

Children

This investor website is intended for adults and is not directed to children under 18. If you believe a child has submitted personal information through the site, contact invest@elflabs.com so we can investigate and take appropriate action.

Changes to this policy

We may update this policy as our practices or applicable requirements change. The effective date above identifies the current version. We will provide additional notice or obtain consent where required by applicable law.

Contact

Elf Labs, Inc. - Privacy Requests

Email: invest@elflabs.com

Mail: 1111 Brickell Ave, 10th Floor, Miami, FL 33131