Data Privacy & Security Overview

LABAU ——————

Data Privacy & Security Overview Architecture, Controls & Regulatory Position

LABAU Holdings, Inc. A Delaware Corporation

For investors, partners and counsel · Confidential · September 2026

Why This Document Exists LABAU serves approximately one thousand of the most privacy-sensitive individuals in New York City. Several are recognisable. For many of them, discretion is not a feature of the service — it is the reason they joined. That makes privacy an architectural requirement rather than a compliance exercise. The controls in this document were designed into the platform before it was built, and several of them constrain what LABAU is permitted to do commercially. STATUS LABAU is pre-launch. The controls described here are specified in the Platform

Technical Specification and are requirements on the build, not audited findings. Where a control is planned rather than implemented, this document says so.

The Four Principles P R I NCI P LE

WHAT IT MEANS I N P RA CTICE

Collect the minimum

LABAU holds member payment credentials for membership billing only. It never receives retail cardholder data, because members pay merchants directly on merchant systems.

Expose the minimum

A store associate sees a first name and a membership number. A driver sees the member’s name and destination but no telephone number, email, order history or profile — and is bound never to say the name aloud. A partner never sees a member’s profile.

Retain the minimum

Hotel guest data is deleted within 24 hours of checkout. Merchant devices cache nothing. Delivery addresses are decrypted only during an active delivery window.

Never monetise member data

LABAU runs no advertising and sells no data. Revenue is membership and partnership fees only. There is no commercial incentive to hold more than the service requires.

1 — What LABAU Holds DATA CATEGORY

HELD?

DETAIL

Member identity

Yes

Name, email, phone, delivery addresses, membership number

Member preferences

Yes

Style profile, sizes, favourite stores, pet profile, purchase and browse history

Membership payment

Tokenised

Card tokenised by the payment processor. LABAU stores a token, never

credential

only

a card number.

Retail payment data

No

Members pay merchants on merchant systems. No cardholder data for retail purchases ever reaches LABAU.

Private calendar events

Driver biometric data

Yes —

My Events entries are encrypted and are not accessible to LABAU staff

encrypted

or any partner.

No

Verification uses the device’s native biometric API. LABAU stores the verification result and metadata, never a biometric template or image.

Driver location

Yes

GPS at each chain-of-custody event, and live during an active delivery only.

Hotel guest data

Delivery photographs

Yes — 24

First name, room number, checkout time from the hotel PMS. Deleted

hours

within 24 hours of checkout.

Yes

Timestamped, GPS-stamped images at collection and delivery, forming the chain of custody record.

The single most important line above is retail payment data. Because members pay merchants directly, LABAU is never merchant of record for a retail sale and no retail cardholder data enters its systems. This materially reduces PCI scope, breach exposure and regulatory surface relative to any marketplace that custodies funds.

2 — Technical Controls 2.1 Encryption · TLS 1.3 in transit across all interfaces, API calls and device communication · AES-256 at rest for all stored member and partner data · Member delivery addresses encrypted at rest and decrypted only during an active delivery window · My Events entries encrypted with no staff or partner access path

2.2 Payment Security · All membership payment data tokenised by the payment processor. No raw card data on LABAU servers. · PCI DSS Level 1 compliance targeted across the platform, with a formal scope assessment forming part of the specialist payment engagement · 3D Secure required on all international cards; fraud detection configured for high-value transactions · Token portability required by design so processors can be changed without members re-entering payment information

2.3 Authentication & Access · Two-factor authentication required on the operations admin panel · Thirty-minute session timeout on administrative sessions · Role-based access control — CEO, Operations Manager and Read Only · Immutable audit log recording every administrative action permanently

2.4 Device Security · Every LABAU-managed device — merchant kiosk iPhones, in-room iPads — enrolled in Apple Business Manager and supervised before deployment · Single-app mode via mobile device management. Devices cannot reach any other application, browser or the internet. · Geo-lock on in-room iPads — non-functional outside the property · No member data cached on merchant devices. Kiosk authentication is always a live API call and the session auto-resets sixty seconds after dispatch.

· Merchant devices fail closed on loss of connectivity — no queued authentication, no cached records · Remote lock and wipe on any device from the admin panel; online and offline status visible in real time

2.5 Chain of Custody Every delivery creates a timestamped, GPS-stamped, photographically evidenced record from collection to delivery, with biometric driver verification at three moments. This is a security control as much as an operational one: it establishes who held an item at every point and makes unattributed handling impossible.

3 — Privacy by Design Several LABAU controls exist purely to protect member discretion, and they constrain the product rather than enable it.

CO NT ROL

PURPOSE

Member name never spoken at

A driver uses a room or unit number. Nothing identifies the member aloud in a

delivery

lobby or corridor.

First name only to store

A merchant kiosk shows a first name, a membership number and an active

associates

status. No address, no phone, no order history.

Double-bag protocol

Merchant packaging inside an unbranded LABAU bag. A delivery does not announce what it is or where it came from.

No price visible on gifts

Gift orders carry no pricing of any kind to the recipient.

Name never spoken aloud

A driver sees the member’s name in the app so they know who they are delivering to. It is never spoken aloud in a lobby, a corridor or at the door, and never disclosed to anyone.

Encrypted private calendar

My Events is inaccessible to LABAU staff. The AI acts on it; no person reads it.

Hotel guest deletion

All guest data purged within 24 hours of checkout, regardless of stay length.

No advertising, ever

LABAU has no ad platform, no tracking pixels for advertisers, and no commercial reason to profile members for third parties.

LABAU does not sell, rent, license or share member data with third parties for their own purposes. Member preference data is never shared with retail partners — a merchant learns that an order was placed, not who the member is or what else they buy. This is a permanent commitment and is reflected in the member-facing Privacy Policy.

4 — Regulatory Position The following are the regimes LABAU expects to engage with. Each should be confirmed in writing with King & Jurgens before launch; this section states the Company’s working position, not a legal opinion.

REGIME

LABAU POSITION

STATUS

New York biometric

Driver verification uses the device’s native biometric API. No

Confirm with counsel

privacy law

biometric template or image is transmitted to or stored on LABAU systems — only a pass or fail result and its metadata. Written driver consent is obtained at onboarding.

PCI DSS

Level 1 targeted. Because no retail cardholder data enters LABAU

In scope of specialist

systems, scope is limited to membership billing and driver gratuity.

work

A formal scope assessment is a deliverable of the specialist payment engagement. Money transmission

LABAU never receives, holds or disburses retail funds and is never

Written confirmation

merchant of record for a retail sale. The only funds handled are its

requested from counsel

own membership revenue and gratuity paid through payroll to drivers. State consumer privacy

LABAU operates in New York only through Year 5, but members

Confirm applicability

laws

may be residents of other states. The Privacy Policy is drafted to

with counsel

support access, deletion and opt-out rights regardless of residence. GDPR / UK GDPR

Not currently in scope — LABAU does not offer services in the EU

Out of scope through

or UK and does not monitor behaviour there. Would become

Year 5

material only on any expansion to London. Breach notification

New York requires notification of affected individuals and the

Plan to be written

Attorney General following a breach of private information. An incident response plan is required before launch.

5 — Third Parties & Open Items 5.1 Third-Party Processors Each of the following receives member or driver data in the course of providing its service. All operate under their own security programmes; LABAU should hold a current data processing agreement with each before launch.

PROVIDER

ROLE

DATA RECEIVED

Stripe

Membership billing, invoicing, driver

Payment credentials (tokenised), billing identity,

gratuity payouts

payout details

AWS

Platform hosting

All platform data, encrypted at rest

Apple Business Manager

Device management

Device identifiers and status; no member data

Starboard via Hire Society

Driver placement and screening

Driver identity and screening records

Ruby Receptionist

Member support line

Member contact details and enquiry content

Pilot

Payroll and bookkeeping

Employee payroll data (including drivers)

Hotel PMS vendors

Guest pass provisioning

Guest first name, room number, checkout time

5.2 Open Items Before Launch · Incident response and breach notification plan — to be written, with counsel · Data processing agreements executed with each processor listed above · PCI DSS scope assessment and Level 1 validation — within the specialist payment engagement · Written counsel confirmation on biometric consent, money transmission and state privacy law applicability · Data retention schedule formalised per data category, beyond the hotel guest 24-hour rule · Member-facing Privacy Policy and Terms of Service finalised by counsel and published before the first member joins · Third-party and open-source component register maintained from the first commit, per the CIIA · Penetration testing and UAT completed in the pre-launch hardening phase

Nothing in this document is a legal opinion or a compliance certification. It describes the architecture LABAU has specified and the positions it intends to take. Each should be confirmed by King & Jurgens LLC, and the security controls validated by testing, before the

platform handles live member data.

LABAU Holdings, Inc. · kristina@labauholdings.com · Confidential