PRIVACY POLICY
RAY PB Inc. | Effective: September 1, 2026
RAY PB Inc., a Delaware corporation authorized to do business in New York ("RAY PB," "we," "us," "our"), rents portable chargers ("Power Banks") through our mobile app, website and self-service stations ("Stations") — together, the "Service". This Policy explains what personal information we collect, why, who we share it with, how long we keep it, how we protect it, and the choices and rights you have.
This Policy is part of our Terms of Service. It applies to the Service as offered in the United States, and to everyone who uses the Service here, including people who rent at a Station without creating an account. Where we offer the Service in another country or region, a separate notice governs that use.

• SummaryWe collect the information needed to rent you a Power Bank, take payment, get the unit back, and keep the network working.
• We never receive your full card number. Payments are processed by Adyen N.V.
• We do not sell your personal information and we do not share it for cross-context behavioural advertising.
• You can ask us for a copy of your data, correct it, or have it deleted, at support@raypb.com.
• We do not knowingly serve anyone under 13.

1. Who We Are and How to Reach UsRAY PB Inc. is the business responsible for the personal information described here.
Email: support@raypb.com Phone: 347-812-1995

• 2.2 Information we collect automaticallyRental records — Station ID, unit ID, dispensing and return times, duration, fees charged, cap and hold amounts.
• Device and app data — device identifiers, IP address, operating system, app version, language, crash reports, session logs.
• Location — with your permission, your device's approximate or precise location, so the app can show nearby Stations and available slots. You can refuse or withdraw this permission in your device settings at any time; the app will still work, but you will have to search for Stations manually. We do not track your location in the background or when the app is closed.
• Cookies and similar technologies on our website and in-app SDKs — see Section 8.
• 2.3 Information from othersTransaction confirmations and outcome data from our Payment Processor (Section 3).
• Operational data from venues that host our Stations — normally aggregate usage, and your details only where needed to resolve an incident at that location.
• Fraud-prevention and identity-verification signals from service providers, used to detect stolen cards and abusive accounts.

2.4 What we do not collectWe do not knowingly collect Social Security numbers, driver's licence or passport numbers, health information, precise background location, or biometric identifiers such as fingerprints, voiceprints or facial-geometry templates. We do not use facial recognition at Stations. If this ever changes, we will update this Policy and give any notice and obtain any consent required by law, including New York City Administrative Code § 22-1201 et seq. (biometric identifier information).
3. Payments, Tap to Pay and Digital WalletsWe accept contactless cards and digital wallets. Payments are processed by Adyen N.V. (the "Payment Processor").

• How the card is read. At a Station, your card or wallet communicates by near-field communication (NFC) with our terminal or with a RAY PB-operated device using Tap to Pay technology. Card data passes encrypted to the Payment Processor. RAY PB does not receive, transmit or store your full card number, expiry date or security code.
• What we do receive. A payment token or reference ID, the last four digits of the card, the card brand, the amount, the timestamp, and the authorisation or decline result. We use this to bill rentals, apply the fee cap, issue receipts, process refunds, and detect fraud.
• Card on file. If you save a card, the Payment Processor stores it and gives us only a token that stands in for your card. As explained in our Terms of Service, you authorise us to use that saved token to charge your card for later amounts connected to your rentals — for example ongoing fees for a multi-day rental, and any late, non-return, loss or damage fees — including charges that we initiate, and whose amount is not known in advance, without you re-entering your card details. You can delete a saved card in the app; if you do, we may still charge a card for amounts you already owe.
• Apple Pay and Google Pay. If you pay with a wallet, Apple Inc. or Google LLC processes data as independent controllers under their own privacy policies. We do not control what they collect.
• Standards. The Payment Processor maintains PCI-DSS compliance. Our own systems are scoped to avoid holding cardholder data.
• 4. How We Use InformationCreate and manage your account and process rentals and returns.
• Take payment, place and release holds, calculate fees, apply the fee cap, and issue refunds and receipts.
• Send transactional messages — rental and return confirmations, receipts, fee notices, safety alerts and recalls.
• Provide customer support and resolve fee and damage disputes.
• Locate and recover units that have not been returned.
• Monitor, maintain, secure and improve the app, website and Station network, including planning where to place Stations.
• Detect, investigate and prevent fraud, theft, unauthorised use and violations of our Terms.
• Send marketing messages only where you have given prior express consent, with an opt-out in every message.
• Comply with legal, tax and accounting obligations, respond to lawful requests, and establish or defend legal claims.

We use automated checks to score transactions for fraud risk and to flag unusual rental patterns. These checks can result in a rental being declined or an account being suspended. We do not make decisions producing legal or similarly significant effects about you by automated means alone without human review, and you may ask a person to review any such decision by writing to privacy@raypb.com.
5. How We Share InformationWE DO NOT SELL YOUR PERSONAL INFORMATION AND WE DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING, AS THOSE TERMS ARE DEFINED UNDER U.S. STATE PRIVACY LAWS.
We share personal information only as follows:

• Payment Processor — to authorise, capture, refund and reconcile transactions.
• Cloud hosting and infrastructure providers — to run the app, website and back-end systems.
• Analytics and crash-reporting providers — in pseudonymous or aggregate form, to understand usage and fix faults.
• Customer support and messaging platforms — to communicate with you.
• Fraud-prevention providers — to verify transactions and detect abuse.
• Venue and location partners — normally aggregate usage data; your identifiers only where necessary to resolve an incident at that venue.
• Professional advisers — lawyers, accountants and auditors, under duties of confidence.
• Successors — in a merger, financing, acquisition or sale of assets, subject to this Policy continuing to apply.
• Authorities and third parties — where required by law, subpoena or court order, or where we reasonably believe disclosure is necessary to prevent fraud, harm or a crime, or to establish or defend legal claims. Where we are permitted to do so, we will tell you before disclosing your data in response to a legal request.

Every service provider acts on our documented instructions under a written contract that requires them to protect your information and prohibits them from using it for their own purposes, except where a recipient acts as an independent controller for its own legal and regulatory obligations. In particular, our Payment Processor and the digital-wallet providers decide for themselves how they use certain data for fraud prevention, anti-money-laundering, sanctions screening and other legal and risk-management duties; for those purposes they act as independent controllers under their own privacy policies, not on our instructions.
When information is no longer needed, we delete, anonymise or aggregate it. We may keep the minimum needed to enforce our Terms, collect an outstanding balance, or comply with law.
7. Data SecurityConsistent with New York's Stop Hacks and Improve Electronic Data Security Act ("SHIELD Act," General Business Law §§ 899-aa and 899-bb), we maintain a written data security program with safeguards appropriate to our size and to the sensitivity of the information we hold:

• Administrative — a designated employee responsible for security, staff training, vendor due diligence and written contracts, an incident response plan, and access on a need-to-know basis.
• Technical — encryption in transit and at rest, multi-factor authentication for administrative access, logging and monitoring for unauthorised access, patching, and periodic security testing.
• Physical — controlled access to systems and premises, tamper-evident Stations, and secure disposal of records containing private information.

No system is perfectly secure. If a breach affects your private information we will notify you in the most expedient time possible and without unreasonable delay, and in any event within thirty (30) days after we discover the breach, except where a delay is required for the legitimate needs of law enforcement. We will also notify the New York Attorney General, the Department of State and the State Police as required by the SHIELD Act; where more than 5,000 New York residents must be notified at one time, we will additionally notify the consumer reporting agencies as to the timing, content and distribution of the notices; and we will notify the regulators of any other state whose residents are affected.
8. Cookies, SDKs and TrackingOur website uses cookies and our app uses software development kits (SDKs) that fall into three groups:

• Strictly necessary — to keep you logged in, remember your basket and secure the session. These cannot be turned off.
• Functional — to remember your language and preferences.
• Analytics — to understand how the Service is used, in pseudonymous form.

We do not use advertising or cross-site tracking cookies. You can control cookies through your browser and reset your advertising identifier in your device settings; disabling some cookies may limit functionality. We honour the Global Privacy Control (GPC) and similar opt-out preference signals. Because we do not sell or share personal information, an opt-out signal does not change what we do, but we record it. Our website does not currently respond to browser "Do Not Track" headers, for which there is no common standard.
9. Your Choices and RightsWhatever state you live in, we offer everyone who uses the Service the following:

• Access — a copy of the personal information we hold about you.
• Correction — to fix information that is inaccurate.
• Deletion — to have your information erased, subject to what we must keep by law (for example transaction records) or to enforce a debt.
• Portability — a copy of your rental and account data in a portable format.
• Opt out of marketing — at any time, in any message or at support@raypb.com. We will still send transactional and safety messages.
• Opt out of sale or targeted advertising — we do not do either, but you may still register a preference.
• Withdraw location permission — in your device settings.
• Human review — of an automated decision that affected you.
• Non-discrimination — we will not deny you service, charge you a different price, or give you a lower quality of service for exercising a right.

How to exercise a right. Email privacy@raypb.com or use the Privacy section of the app. We will verify your identity through the email or mobile number on your account before acting, and we may ask for additional information if the request is made through an authorised agent. We respond within 45 days, and may extend once by a further 45 days where the request is complex, telling you why. There is no charge unless a request is manifestly unfounded or excessive.
If we decline. We will tell you why and how to appeal. Appeals go to privacy@raypb.com marked "Privacy Appeal" and are answered within 45 days. If your appeal is denied, you may complain to your state Attorney General.
10. Children The Service is intended for individuals who are at least thirteen (13) years old. We do not knowingly collect personal information online from children under thirteen (13). If we learn that we have collected personal information online from a child under thirteen (13) without the verifiable parental consent required by applicable law, we will take reasonable steps to delete that information. If you are a parent or legal guardian and believe that a child under thirteen (13) has provided personal information to us, please contact us at support@raypb.com 11. Where Your Information Is ProcessedWe and our service providers process personal information in the United States. Some providers, including our Payment Processor, may process or store data outside the United States. Where they do, they are bound by contractual safeguards requiring protection equivalent to that described in this Policy.
12. Notices at StationsWhere a Station displays a screen or a printed notice about data collection — for example, a camera notice, or a short-form notice about contactless payment — that notice supplements this Policy. In the event of a conflict, this Policy governs.
13. Accessibility of This PolicyIf you need this Policy in an alternative format, or need help exercising a privacy right, contact support@raypb.com or call 347-812-1995and we will assist you.
14. Changes to This PolicyWe may revise this Policy. If a change is material, we will notify you by email and by in-app or on-Station notice at least fifteen (15) days before it takes effect, and we will keep the previous version available on request. The "Last Updated" date above shows the most recent revision. Continued use of the Service after the effective date means you accept the revised Policy; where the law requires your consent to a change, we will ask for it.
15. Contact and Complaints support@raypb.com | 347-812-1995 | www.raypb.com