SPOTHUB PRIVACY POLICY

Effective Date: September 16, 2026

SpotHub respects your privacy and is committed to handling information responsibly and transparently.

This Privacy Policy explains how KIRUNIVERSE LLC, a New York limited liability company operating the SpotHub brand (“KIRUNIVERSE,” “SpotHub,” “we,” “us,” or “our”), collects, uses, discloses, stores, and otherwise handles information when you access or use the SpotHub website, web application, progressive web application, QR-based experiences, and related services (collectively, the “Platform”).

This Privacy Policy should be read together with the SpotHub User Terms & Conditions.

If you do not agree with this Privacy Policy, you should not use SpotHub.

1. Information We Collect

The information SpotHub collects depends on how you interact with the Platform.

Information Collected Automatically

When you access or use SpotHub, we or our service providers may automatically collect certain technical and usage information, including:

• pages or screens viewed;

• features used;

• links or buttons selected;

• Vendor or Hotel Partner pages viewed;

• QR-code or other entry method used to access SpotHub;

• referring source or page;

• date and time of activity;

• browser type;

• device type;

• operating system;

• approximate technical information associated with an Internet connection, such as IP address;

• Platform errors, performance information, and diagnostic data; and

• other similar information necessary to operate, secure, measure, and improve the Platform.

SpotHub may associate activity with a session, device, browser, Hotel Partner, QR entry point, market, or other non-account identifier where appropriate.

Information You Provide Voluntarily

You may provide information directly to SpotHub when you:

• contact us;

• report inaccurate Vendor information;

• submit a question, complaint, or request;

• communicate with us by email;

• participate in a survey or feedback opportunity;

• exercise a privacy or legal right; or

• otherwise voluntarily provide information.

Depending on the interaction, this information may include your name, email address, contact information, message contents, and any other information you choose to provide.

Please do not provide sensitive personal information unless it is reasonably necessary for the purpose of your communication.

2. Terms and Privacy Acceptance Records

SpotHub may require users to affirmatively accept the SpotHub User Terms & Conditions, this Privacy Policy, or updated versions of those documents before continuing to use the Platform.

When you provide such acceptance, we may maintain a record that includes:

• the fact that acceptance occurred;

• the date and time of acceptance;

• the version of the Terms and/or Privacy Policy accepted;

• the Platform or interface through which acceptance occurred;

• technical or session information reasonably necessary to document the acceptance; and

• other information reasonably necessary to establish and maintain an accurate record of consent or agreement.

We may retain these records for legal, compliance, security, evidentiary, and business-record purposes.

3. QR Codes, Hotels and Entry Sources

SpotHub may be accessed through QR codes, links, printed materials, Hotel Partner communications, staff recommendations, door hangers, or other distribution methods.

When a QR code or other SpotHub link identifies a particular Hotel Partner, property, market, campaign, or distribution source, SpotHub may record that source.

For example, we may measure that a user entered SpotHub through a QR code associated with a particular hotel.

This allows us to understand matters such as:

• which Hotel Partners generate Platform usage;

• which distribution methods are effective;

• which markets receive engagement;

• how users navigate SpotHub after entering through a particular source; and

• how SpotHub can improve its services for users, Vendors, and Hotel Partners.

Accessing SpotHub through a hotel-associated QR code does not, by itself, tell SpotHub your room number, reservation information, identity, payment information, or other information held by the hotel.

SpotHub does not require Hotel Partners to provide guest lists, reservation records, payment information, or other personally identifying hotel records as a condition of participating in SpotHub.

4. Analytics and Platform Measurement

SpotHub uses or may use analytics, logging, cookies, similar technologies, and service-provider tools to understand how the Platform is used.

These systems may measure information such as:

• Platform visits;

• page and Vendor views;

• Hotel Partner and QR entry sources;

• market and locale engagement;

• navigation patterns;

• outbound Vendor interactions;

• category engagement;

• repeat Platform usage where technically and legally appropriate;

• device and browser information;

• Platform performance;

• errors and technical events; and

• other information useful for operating and improving SpotHub.

SpotHub currently maintains first-party Platform event logging and may use infrastructure and database providers to process or maintain operational and analytical information.

As our analytics infrastructure develops, SpotHub may use providers such as Google Analytics, Vercel, and Supabase for appropriate analytics, infrastructure, database, performance, security, or logging functions.

We will configure analytics and tracking technologies in accordance with applicable law and will update our disclosures when our practices materially change.

5. Cookies and Similar Technologies

SpotHub may use cookies, browser storage, pixels, tags, session identifiers, and similar technologies where appropriate.

These technologies may be used to:

• operate essential Platform functionality;

• remember settings or choices;

• maintain sessions;

• document acceptance of legal terms;

• understand Platform usage;

• measure performance;

• detect errors;

• improve security;

• prevent fraud or abuse; and

• perform analytics.

Some technologies may be necessary for SpotHub to operate correctly. Others may be used for analytics or other optional purposes.

Where applicable law requires consent or provides a right to decline particular categories of tracking, SpotHub will provide appropriate choices.

If SpotHub provides privacy or cookie controls, we intend those controls to accurately reflect and control the technologies described through the interface.

Browser settings may also allow you to restrict or delete certain cookies or stored information. Blocking some technologies may affect Platform functionality.

6. Location Information

SpotHub does not currently collect precise device location for its general local-discovery functionality.

SpotHub locations, markets, hotel-associated experiences, and local Vendor results may instead be determined through the page, Hotel Partner, QR code, link, market, or locale through which a user accesses the Platform.

We may receive approximate geographic information derived from technical information such as an IP address through infrastructure or analytics services.

SpotHub may introduce optional device-location features in the future to provide functionality such as nearby results, distance sorting, or location-aware discovery.

Before introducing collection of precise device location, we will provide appropriate disclosure and obtain permission where required by applicable law or device/platform rules.

7. How We Use Information

We may use information collected through SpotHub to:

• provide and operate the Platform;

• display relevant local information;

• understand how users interact with SpotHub;

• measure Hotel Partner and QR-code engagement;

• measure Vendor visibility and engagement;

• improve Vendor categories, discovery, navigation, and Platform design;

• understand which markets and features are useful;

• develop and evaluate new features;

• maintain records of Terms and Privacy Policy acceptance;

• communicate with users who contact us;

• respond to questions, requests, complaints, and reports;

• maintain Platform security;

• detect, investigate, and prevent fraud, misuse, attacks, or unlawful activity;

• diagnose technical problems;

• maintain and improve Platform performance;

• comply with legal obligations;

• establish, exercise, or defend legal claims; and

• protect the rights, property, security, and legitimate interests of KIRUNIVERSE, SpotHub, our users, Vendors, Hotel Partners, and others.

We may also create aggregated or de-identified information that does not reasonably identify an individual and use that information for business analysis, Platform development, reporting, and other lawful purposes.

8. How We Disclose Information

SpotHub does not disclose personal information indiscriminately.

We may disclose information in the following circumstances.

Service Providers

We may provide information to companies that help us operate SpotHub, including providers of:

• hosting and cloud infrastructure;

• databases;

• analytics;

• performance monitoring;

• security;

• communications;

• technical support; and

• other services necessary to operate and improve the Platform.

These providers may process information on our behalf or according to their respective roles and contractual arrangements.

Legal and Safety Purposes

We may disclose information where we reasonably believe disclosure is necessary to:

• comply with applicable law, regulation, subpoena, court order, or lawful governmental request;

• protect or enforce our rights or agreements;

• investigate fraud, abuse, security incidents, or unlawful activity;

• protect the safety, rights, or property of SpotHub, KIRUNIVERSE, users, Vendors, Hotel Partners, or others; or

• establish, exercise, or defend legal claims.

Business Transactions

If KIRUNIVERSE or SpotHub is involved in a merger, acquisition, financing, restructuring, sale of assets, corporate reorganization, bankruptcy, or similar transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law.

With Your Direction or Consent

We may disclose information when you direct us to do so or otherwise provide appropriate consent.

9. Selling and Sharing Personal Information

SpotHub does not currently sell personal information for money.

SpotHub does not currently operate a behavioral advertising program through which we intentionally provide users' personal information to advertisers for cross-context behavioral advertising.

If SpotHub introduces advertising, sponsorship, or marketing technologies that materially change how personal information is collected, used, sold, shared, or disclosed, we will evaluate applicable legal requirements and update our privacy disclosures and controls as appropriate before implementing those practices.

10. Advertising

SpotHub may introduce advertising, sponsorships, promoted Vendor placements, or other commercial promotional opportunities.

Advertising within SpotHub does not necessarily require behavioral tracking or the sale of personal information.

If future advertising features involve additional tracking technologies, profiling, targeted advertising, or disclosures of personal information to advertising partners, SpotHub will evaluate the applicable privacy requirements and provide any disclosures, consent mechanisms, or opt-out rights required by law.

11. Vendors and Third-Party Services

SpotHub connects users with independent Vendors and may provide links to Vendor websites, telephone numbers, social-media profiles, mapping services, reservation platforms, or other third-party services.

When you leave SpotHub or interact directly with a third party, that third party may collect information independently.

Their collection and use of information is governed by their own privacy practices, not this Privacy Policy.

We encourage users to review the privacy policies of third parties before providing them with personal information.

12. Hotel Partners

Participating Hotel Partners operate independently from SpotHub.

A Hotel Partner's own collection and use of guest information is governed by the hotel's policies and applicable law.

SpotHub does not assume responsibility for a Hotel Partner's independent privacy practices merely because that hotel provides guests with access to SpotHub.

Likewise, Hotel Partners do not administer SpotHub's privacy practices merely because they make SpotHub available to guests.

Unless separately agreed and lawfully implemented, SpotHub does not require Hotel Partners to transfer guest reservation records, payment information, room numbers, or guest lists to SpotHub.

13. Data Retention

We retain information for as long as reasonably necessary for the purposes for which it was collected, including to:

• operate and improve SpotHub;

• maintain appropriate business records;

• analyze Platform performance and usage;

• maintain security and prevent abuse;

• document legal agreements and acceptance;

• comply with legal, accounting, regulatory, or reporting requirements;

• resolve disputes; and

• establish, exercise, or defend legal claims.

Retention periods may vary depending on the type of information, the reason it was collected, applicable legal requirements, and legitimate business needs.

When information is no longer reasonably necessary, we may delete, anonymize, aggregate, or otherwise dispose of it in accordance with applicable law and our operational practices.

14. Data Security

KIRUNIVERSE uses reasonable administrative, technical, and organizational measures designed to protect information under our control.

However, no website, application, database, transmission method, or storage system can be guaranteed to be completely secure.

Users should therefore understand that we cannot guarantee absolute security.

15. Your Privacy Choices and Rights

Depending on where you live and which privacy laws apply to SpotHub or to a particular processing activity, you may have rights concerning your personal information.

These may include rights to:

• request information about personal information we maintain about you;

• request access to certain personal information;

• request correction of inaccurate information;

• request deletion of certain information;

• opt out of certain uses or disclosures;

• withdraw consent where processing is based on consent;

• appeal certain privacy decisions where applicable; or

• exercise other rights provided by applicable law.

These rights are not identical in every jurisdiction and may be subject to exceptions.

To submit a privacy request, contact:

spothub@kiruniverse.com

We may take reasonable steps to verify a request before acting upon it.

We will not unlawfully discriminate against a user for exercising an applicable privacy right.

16. Browser and Device Privacy Controls

Your browser, operating system, or device may provide controls relating to cookies, storage, permissions, tracking, or other technologies.

Using these controls may affect how SpotHub or third-party services operate.

Where SpotHub provides its own privacy controls, we will endeavor to ensure that those controls accurately perform the choices they describe.

17. Do Not Track and Other Preference Signals

Browsers and devices may transmit privacy preference signals.

The legal and technical requirements governing these signals continue to develop and may vary by jurisdiction and type of signal.

Where applicable law requires SpotHub to recognize or respond to a legally valid privacy preference signal, we will do so as required.

18. Children's Privacy

SpotHub is a general-audience service and is not directed to children under 13.

We do not knowingly collect personal information from children under 13 in a manner prohibited by applicable law.

If we learn that we have collected personal information from a child under 13 in circumstances requiring parental consent and that consent was not obtained, we will take appropriate steps consistent with applicable law.

A parent or guardian who believes a child has provided personal information to SpotHub may contact us at:

spothub@kiruniverse.com

19. Users Outside Our Initial Markets

SpotHub is operated by KIRUNIVERSE LLC in the United States and is initially focused on markets within the United States.

As SpotHub expands geographically, privacy requirements may differ among jurisdictions.

Where applicable law provides additional rights or imposes additional requirements, SpotHub will endeavor to provide the disclosures, controls, and protections required for users in those jurisdictions.

The availability of SpotHub in a jurisdiction does not mean every privacy law of that jurisdiction necessarily applies to KIRUNIVERSE or every processing activity.

20. Changes to This Privacy Policy

We may update this Privacy Policy as SpotHub evolves, our technology or business practices change, new features are introduced, service providers change, or legal requirements develop.

When we update this Policy, we will revise the Effective Date.

For material changes, we may provide additional notice through the Platform or request affirmative acknowledgement or consent where required by applicable law.

When changes require consent, we will seek that consent before applying the relevant practice where legally required.

21. Contact SpotHub

Questions, privacy requests, concerns, or other communications regarding this Privacy Policy or SpotHub's privacy practices may be directed to:

KIRUNIVERSE LLC / SpotHub

Email: spothub@kiruniverse.com

Website: getspothub.com