Privacy Policy

1. Introduction

This Privacy Policy describes how Fukui Labs, Inc. d/b/a Bottega Studio ("Bottega," "we," "us," or "our") collects, uses, stores, and shares personal information when you use the Bottega Studio platform and related services (the "Services"). This policy supplements our Terms of Service ("Terms" or "ToS"), and capitalized terms used but not defined here have the meanings given in the Terms. By creating an Account or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

2. Information We Collect

2. 1 Account Information

When you create an Account, we collect information necessary to set up and maintain your account, including your name, email address, and billing information such as your billing address and payment method details.

2. 2 User Content

You may upload or create User Content within the Services, as defined in Section 6 of the Terms. User Content includes creative works, notes, worldbuilding materials, text, images, files, metadata, tags, annotations, and other content you upload

to or author within the Services. We collect and store this content to provide and operate the Services.

2. 3 Usage Data

We automatically collect certain information when you access or use the Services, including:

• Log data (access times, pages viewed, errors encountered)
• Device information (hardware model, operating system, unique device identifiers)
• IP address
• Browser type and version
• Pages visited and features used within the Services
• Timestamps and session duration
• Referring URLs and search terms used to find the Services

2. 4 Payment Information

Payments are processed by our third-party payment processor, Stripe. When we accept payments, we will update this section.

2. 5 Communications

When you contact us via email, through in-app support, or by other means, we collect the content of your messages, your email address, and any other information you choose to provide. We retain these communications to respond to your inquiries and improve our support.

2. 6 Cookies and Tracking Technologies

We use cookies, pixels, and similar tracking technologies to operate, secure, and improve the Services. These technologies help us remember your preferences, understand how you interact with the Services, and measure the effectiveness of our communications. The Services use the following cookies and local storage: (a) a session cookie set by our authentication provider for sign-in; (b) a sidebar preference cookie (sidebar_state)

that remembers your layout choice. We do not use tracking cookies, advertising pixels, or cross-site tracking technologies.

3. How We Use Your Information

We use the information we collect to provide, maintain, and improve the Services. We use your information to deliver the features you request, maintain the security and performance of the Services, and develop new features and improvements.

• Process transactions. We use billing and payment information to process Subscription charges, send transaction confirmations, and manage your account balance.
• Send notices and updates. We send you technical notices, security alerts, Subscription-related updates, and support and administrative messages related to the Services.
• Respond to requests. We use your contact information and communications to respond to your comments, questions, and customer support requests.
• Monitor and analyze usage. We analyze trends, usage patterns, and activities in connection with the Services to understand how the Services are used and to inform product decisions.
• Detect and prevent fraud. We use information to detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal or harmful activities.
• AI processing of User Content. We process your User Content using our AI features solely to provide AI-Derived Insights to you, as described in Section 7 of the Terms. This processing is performed to deliver the core functionality of the Services and is not used for any other purpose.
• Generate Aggregated Data and De-Identified Data. As described in Section 6.2(b) of the Terms, we may convert User Content and usage data into Aggregated Data or De-Identified Data for product improvement and development. Once aggregated or de-

identified, this data can no longer identify any individual user, Account, or specific User Content.

• Comply with legal obligations. We use your information as necessary to comply with applicable law, legal process, or government requests.

4. How We Share Your Information

We share your information only in the following circumstances:

4. 1 Service Providers

We engage third-party companies and individuals to perform services on our behalf, such as payment processing (Stripe), cloud hosting, data analytics, and customer support. These service providers have access to your personal information only to perform tasks on our behalf and are contractually obligated not to disclose or use it for any other purpose.

4. 2 Legal Requirements

We may disclose your information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, or legal process, including court orders and subpoenas; (b) protect the rights, property, or safety of Bottega, our users, or the public; or (c) detect, prevent, or address fraud, security issues, or technical problems.

4. 3 Business Transfers

In connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of Bottega's assets, your personal information may be transferred to the acquiring entity. Consistent with Section 18.4 of the Terms, any successor or assignee must assume all of Bottega's obligations under these Terms, including all obligations relating to User Content and Confidential Information. We will provide notice of any such transfer as required by applicable law.

4. 4 With Your Consent

We may share your information with third parties when you direct us to or provide your explicit consent.

4. 5 Aggregated and De-Identified Data

We may share Aggregated Data and De-Identified Data with third parties for industry analysis, product benchmarking, and other purposes. Because this data does not identify any individual user, Account, or specific User Content, it is no longer considered personal information under this Privacy Policy.

4. 6 What We Do Not Do

We do not sell your personal information. We have not sold personal information, and we have no plans to do so. We do not share your User Content with third parties for advertising or AI training purposes. As stated in Section 6.3 of the Terms, we will not sell or license your User Content to third parties, use it for advertising or promotional purposes. Bottega does not use User Content to train any AI model and does not retain User Content in any third-party AI system beyond the duration of a processing request. All third-party AI providers used by Bottega operate under zero data retention agreements.

5. Data Retention

5. 1 Account Data

We retain your Account information for as long as your Account remains active or as needed to provide the Services to you.

5. 2 User Content

Upon expiration or termination of your Subscription or Account, you will have 60 days to export or download your User Content using the export tools available in the Services, consistent with Section 6.5 of the Terms. After that 60-day window, we will permanently delete your User Content from our active systems, except to the extent we are required to retain it by applicable law or to the extent it is included in routine backup archives that are deleted in the ordinary course.

5. 3 Usage Data

We retain usage data for reasonable periods necessary for analytics, security monitoring, and product improvement. When usage data is no longer needed for these purposes, we delete or de-identify it.

5. 4 Legal Hold Exceptions

Notwithstanding the foregoing, we may retain any information as required by applicable law, regulation, or legal process, or as necessary to enforce our Terms, resolve disputes, or protect our legal rights.

6. Data Security

We implement commercially reasonable administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Encryption of data at rest

• Access controls and authentication mechanisms
• Regular security assessments and monitoring No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a Security Incident, we will follow the notification procedures described in Section 11.4 of the Terms, including notifying you within 72 hours of becoming aware of the incident.

7. Your Rights and Choices

We respect your ability to control your personal information. Depending on your state of residence, you may have some or all of the rights described below.

7. 1 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides you with the following rights:

• Right to Know/Access. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected the information, the business or commercial purposes for collection, and the categories of third parties with whom we share the information.

• Right to Delete. You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions permitted by law.

• Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.

• Right to Opt Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. As noted above, we do not sell your personal information and do not share it for cross-context behavioral advertising.

• Right to Limit Use of Sensitive Personal Information. You have the right to limit the use and disclosure of your sensitive personal information to purposes necessary to provide the Services. We use sensitive personal information only for purposes permitted under the CCPA/CPRA.

• Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights. We will not deny you the Services, charge you different prices, or provide a different level of quality based on your exercise of these rights.

8. Children’s Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13, consistent with Section 3.1 of the Terms. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe that a child under 13 has provided personal information to us, please contact us at hello@fukuilabs.com.

9. Third-Party Services

The Services may integrate with or contain links to third-party services, platforms, and websites that are not operated by Bottega. As described in Section 10 of the Terms, your use of Third-Party Services is governed by their respective terms of service and privacy policies. We are not responsible for the content, security, privacy practices, or availability of any Third-Party Services. We encourage you to review the privacy policies of any Third-Party Services before providing your personal information to them. Any concerns about a Third-Party Service should be directed to its provider.

10. International Data Transfers

The Services are operated from and data is processed in the United States. If you access the Services from outside the United States, your information will be transferred to, stored,

and processed in the United States, where privacy laws may differ from those in your jurisdiction. By using the Services, you consent to the transfer of your information to the United States and acknowledge that your information will be subject to U.S. law. The Services may connect with or integrate with third-party services, platforms, or tools. Your use of such third-party services is governed by their respective terms of service and privacy policies, not by these Terms.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, applicable law, or our practices. If we make material changes, we will provide you with at least 30 days’ advance notice before the changes take effect, consistent with Section 17 of the Terms. Notice will be provided via: (a) an email to the address associated with your Account; (b) a prominent notice within the Services; or (c) posting the updated Privacy Policy to our website with a revised "Last Updated" date. Your continued use of the Services after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated Privacy Policy, you must stop using the Services and cancel your Subscription before the changes take effect.

12. Contact Information

If you have questions about this Privacy Policy, want to exercise your privacy rights, or need to contact us for any reason related to your personal information, please reach out to:

This Privacy Policy was last updated on March 19, 2026.