Effective Date: May 1, 2026 Last Updated: May 29, 2026 Version: 1.0

1. Introduction and Scope

Ziru Labs, Inc. ("Ziru Labs," "we," "us," or "our") is committed to protecting the privacy and security of personal information entrusted to us. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information in connection with our website at zirulabs.com (the "Website") and our communications with counterparties, partners, journalists, researchers, and other parties who interact with us through the Website or other channels.

This Policy applies to personal information processed by Ziru Labs in our capacity as a data controller. It does not apply to information processed on behalf of our counterparties in the course of providing services under separate contractual arrangements; such processing is governed by the applicable agreements between Ziru Labs and the relevant counterparty.

By using the Website or submitting personal information to us, you acknowledge that you have read and understood this Policy.

2. Data Controller and Contact Information

The data controller responsible for the personal information processed under this Policy is:

Martin Ventures Ltd. dba Ziru Labs, 1375 East 9th St., One Cleveland Center 29th Floor, Cleveland, OH 44114.

For all privacy inquiries, requests to exercise rights, or other questions regarding this Policy, contact us at contact@zirulabs.com, with "Privacy Inquiry" in the subject line where applicable.

3. Information We Collect

We practice data minimization as a matter of operating principle. We collect the categories of personal information described below and no more than is reasonably necessary for the purposes identified in Section 5.

3.1 Information You Provide Directly

When you submit our Website contact form, send us correspondence, or otherwise communicate with us, you may provide the following categories of information: your name; your business email address; the name of your organization or affiliation; your role or title within your organization; your country or region; the nature of your inquiry; and the substantive content of your message. You may also voluntarily provide additional information relevant to your inquiry.

We do not collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning sex life or sexual orientation), and we request that you not include such information in communications with us unless it is strictly necessary and you have provided your explicit consent.

3.2 Information Collected Automatically

When you access the Website, our hosting provider and content delivery network may automatically collect certain technical information for security, operational integrity, and analytical purposes. This information may include: your Internet Protocol (IP) address; your device type, operating system, and browser type; the date, time, and duration of your visit; the pages or resources you accessed; the referring URL; and aggregate usage patterns. Some of this information is collected in the form of server logs and may constitute personal information under applicable law.

3.3 Information from Third Parties

We may receive information about you from public sources (such as your employer's website, professional networking platforms, or publicly available regulatory filings) where such information is relevant to evaluating a prospective counterparty engagement, conducting due diligence, or complying with export-control and sanctions screening obligations described in Section 14.

4. Legal Bases for Processing (EU/UK/Switzerland)

For individuals located in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on one or more of the following legal bases under Article 6 of the General Data Protection Regulation (and its UK and Swiss equivalents):

(a) Consent, where you have provided clear affirmative consent for a specific processing purpose; (b) Performance of a contract or pre-contractual steps taken at your request, including in connection with evaluating a prospective business relationship; (c) Compliance with a legal obligation to which Ziru Labs is subject, including export-control, sanctions, anti-money-laundering, and corporate-records obligations; (d) Legitimate interests pursued by Ziru Labs or by a third party, including operating and securing the Website, evaluating prospective counterparties, conducting business communications, and protecting our legal interests, except where such interests are overridden by your interests, rights, or freedoms; and (e) Vital interests or public interest, where applicable.

Where we rely on legitimate interests, we conduct balancing assessments to ensure that our processing is proportionate and that your rights and freedoms are appropriately protected.

5. How We Use Personal Information

We use personal information for the following purposes:

To respond to inquiries submitted through the Website contact form, by email, or through other communication channels; to evaluate prospective business relationships, partnerships, standards-body engagements, journalistic inquiries, academic and research collaborations, and similar counterparty interactions; to operate, secure, monitor, and improve the Website, including detection and prevention of fraud, abuse, and unauthorized access; to comply with applicable legal, regulatory, and contractual obligations, including export-control, sanctions, tax, accounting, and corporate-records requirements; to conduct corporate communications, including circulation of research publications, standards-body submissions, and similar materials to interested parties who have indicated they wish to receive such communications; to enforce and defend our legal rights and the rights of third parties; and for such other purposes as may be disclosed to you at the time of collection or to which you have consented.

We do not sell personal information. We do not share personal information with third parties for their own marketing purposes. We do not engage in behavioral advertising on the Website.

6. Sharing and Disclosure of Personal Information

We share personal information only with the categories of recipients identified below and only as reasonably necessary for the purposes identified in Section 5.

Service Providers. We share personal information with third-party service providers that perform functions on our behalf, including website hosting, content delivery, email infrastructure, productivity software, customer-relationship management, security monitoring, and professional services (legal, accounting, audit, and similar). These service providers are contractually bound to process personal information only in accordance with our instructions and to maintain appropriate technical and organizational security measures.

Affiliates and Subsidiaries. We may share personal information with our affiliates and subsidiaries where such sharing is consistent with the purposes identified in this Policy and subject to comparable protections.

Professional Advisors. We may share personal information with our legal, accounting, audit, insurance, and other professional advisors as reasonably necessary in connection with their services to us.

Government Authorities and Legal Process. We may disclose personal information to government, regulatory, or law-enforcement authorities, courts, or other parties where we believe in good faith that such disclosure is required by applicable law, legal process, or regulatory directive; necessary to protect our rights, property, or safety, or the rights, property, or safety of others; or necessary to investigate, prevent, or take action regarding actual or suspected illegal activities. As a U.S.-based operator working with federal and allied counterparties, we may be subject to specific governmental disclosure obligations under applicable law.

Corporate Transactions. In the event of a merger, acquisition, financing, reorganization, bankruptcy, sale of all or substantially all of our assets, or similar corporate transaction, personal information may be transferred to the relevant counterparty, subject to customary confidentiality protections.

With Your Consent. We may share personal information with other parties where you have provided your consent to such sharing.

7. International Data Transfers

Ziru Labs is headquartered in the United States. Personal information that we collect may be transferred to, processed in, and stored in the United States and in other jurisdictions in which we or our service providers operate. These jurisdictions may have data-protection laws that differ from those in your country of residence.

For transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland to jurisdictions that have not been determined by the relevant authorities to provide an adequate level of data protection, we implement appropriate safeguards in accordance with applicable law, which may include the Standard Contractual Clauses adopted by the European Commission (and the UK International Data Transfer Addendum or the Swiss equivalent, as applicable), supplementary technical and organizational measures where required by applicable guidance, or other lawful transfer mechanisms.

You may request additional information regarding the safeguards we apply to international transfers by contacting us at contact@zirulabs.com.

8. Data Retention

We retain personal information for the period reasonably necessary to fulfill the purposes for which it was collected, including any period required to satisfy our legal, regulatory, accounting, tax, contractual, audit, or corporate-records obligations, and any period reasonably necessary to establish, exercise, or defend legal claims.

The specific retention period for any given category of personal information depends on the nature of the information, the purpose for which it was collected, applicable legal and regulatory requirements, and our legitimate interests. As a general matter, contact-form submissions and related correspondence are retained for as long as may be necessary to address the inquiry, evaluate any resulting business relationship, and satisfy applicable record-keeping obligations. Where personal information is no longer required, we delete, anonymize, or otherwise dispose of it in accordance with our information-management procedures.

You may request information regarding the retention period applicable to a specific category of personal information by contacting us at contact@zirulabs.com.

9. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information. We honor these rights in accordance with applicable law and our operational capacity to verify the identity of the requester.

Right of Access. You may request confirmation of whether we process personal information about you and, if so, access to such information and information about the processing.

Right to Rectification. You may request that we correct or complete personal information that is inaccurate or incomplete.

Right to Erasure (Right to Be Forgotten). You may request that we delete personal information about you, subject to applicable exceptions including our legal obligation to retain information for compliance, regulatory, audit, or legal-defense purposes.

Right to Restriction of Processing. You may request that we restrict our processing of personal information about you in certain circumstances.

Right to Data Portability. Where processing is based on consent or contract and carried out by automated means, you may request that we provide personal information about you in a structured, commonly used, and machine-readable format, and that we transmit such information to another controller where technically feasible.

Right to Object. You may object to our processing of personal information about you on grounds related to your particular situation where the processing is based on our legitimate interests.

Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Right to Lodge a Complaint. You may lodge a complaint with the supervisory authority in your jurisdiction. We encourage you to contact us first so we have the opportunity to address your concerns directly.

To exercise any of these rights, contact us at contact@zirulabs.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before processing your request, and we may decline requests that we cannot lawfully fulfill or that are manifestly unfounded or excessive.

10. Cookies and Similar Technologies

The Website uses a limited number of cookies and similar technologies necessary for the operation, security, and basic analytics of the Website. We use strictly necessary cookies that are required for the Website to function and that do not require consent under applicable law. Where we use any cookies that do require consent under applicable law, we will obtain such consent through an appropriate cookie banner or comparable mechanism before such cookies are placed.

We do not use advertising cookies, cross-site tracking technologies, social-media tracking pixels, or third-party analytics cookies for behavioral profiling. You may configure your browser to refuse cookies or to alert you when cookies are being set; however, some features of the Website may not function properly if cookies are disabled.

11. Security

We implement reasonable technical and organizational security measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit, access controls, secure hosting infrastructure, regular security review of our systems and processes, and personnel training on confidentiality and information-handling practices.

No method of transmission over the Internet or method of electronic storage is fully secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authorities and affected individuals in accordance with applicable law.

12. Children's Privacy

The Website and our services are directed exclusively to adults engaging with Ziru Labs in a professional or business capacity. We do not knowingly collect personal information from children under 16 years of age (or under such other age threshold as may apply in your jurisdiction). If you believe that we may have collected personal information from a child, contact us at contact@zirulabs.com and we will take appropriate steps to delete such information.

13. Third-Party Links

The Website may contain links to third-party websites, services, or resources operated by parties other than Ziru Labs, including academic publications, standards-body resources, regulatory documents, and similar references. This Policy does not apply to such third-party sites. We encourage you to review the privacy practices of any third-party site you access through links from the Website.

14. Export-Control and Sanctions Compliance Screening

Ziru Labs operates in the deep-tech and dual-use technology sectors and is subject to applicable export-control, sanctions, anti-money-laundering, and counterparty-screening obligations under U.S., European, U.K., and allied legal regimes. These obligations may include those imposed under the Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC), and equivalent regulations in other jurisdictions.

In connection with our compliance obligations, we may screen the personal information and organizational affiliations provided by parties who contact us against publicly available denied-parties lists, sanctions lists, and other regulatory references. We may decline to engage in further communication or business activity with any party whose engagement would be prohibited or restricted by applicable export-control or sanctions law, and we may retain records of such screenings for the period required by applicable law.

This screening is conducted on the legal basis of compliance with legal obligations to which Ziru Labs is subject, and where applicable, on the legal basis of our legitimate interests in conducting compliance review. By contacting Ziru Labs, you acknowledge that your communication may be subject to such screening.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, applicable law, or other factors. When we make material changes, we will revise the Last Updated date at the top of this Policy and, where required by applicable law or where the changes are significant, provide additional notice through the Website or by direct communication. We encourage you to review this Policy periodically.

16. Jurisdiction-Specific Disclosures

16.1 California (CCPA and CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), including the right to know what personal information we have collected about you, the right to delete such personal information, the right to correct inaccurate personal information, the right to opt out of any sale or sharing of personal information (Ziru Labs does not sell or share personal information as those terms are defined under the CCPA), and the right to limit the use and disclosure of sensitive personal information (Ziru Labs does not collect sensitive personal information for purposes that would trigger this right).

To exercise any of these rights, contact us at contact@zirulabs.com. You may authorize an agent to make a request on your behalf, subject to the verification requirements of the CCPA.

We do not discriminate against you for exercising your rights under the CCPA.

16.2 European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in Section 9. The legal bases on which we rely for processing your personal information are identified in Section 4. You may lodge a complaint with the data-protection supervisory authority in your jurisdiction. We do not currently have a designated Data Protection Officer or EU Representative; should we appoint one, the relevant contact details will be added to this Policy.

16.3 Canada

If you are located in Canada, we process personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You have the right to access, correct, and request information about the processing of your personal information by contacting us at contact@zirulabs.com.

16.4 Australia

If you are located in Australia, we process personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may make a complaint regarding our handling of your personal information to the Office of the Australian Information Commissioner.

16.5 Brazil

If you are located in Brazil, we process personal information in accordance with the Lei Geral de Proteção de Dados Pessoais (LGPD). You have the rights identified in Article 18 of the LGPD, and you may exercise those rights by contacting us at contact@zirulabs.com.

16.6 Other Jurisdictions

If you are located in another jurisdiction with applicable data-protection law, we process personal information in accordance with that law to the extent it applies to our processing, and we honor the rights granted to you under that law in accordance with its terms.

17. Contact Us

For all privacy inquiries, requests, complaints, or questions regarding this Policy, contact us at:

Email: contact@zirulabs.com Subject Line: Privacy Inquiry

Postal Address: Martin Ventures Ltd. dba Ziru Labs, Attention: Privacy, 1375 East 9th St., One Cleveland Center 29th Floor, Cleveland, OH 44114.

We will respond to your inquiry within the timeframes required by applicable law.