Privacy Policy

1. Scope

This Privacy Policy applies to personal information processed by us in connection with the Mavin mobile application, the mymavin.ai website, and any other services or interfaces owned or controlled by Runda Lab that link to this Privacy Policy (each a "Service" and together, the "Services").

We collect what we need to run the Services, we use it for purposes you would expect, and we give you meaningful control, including the right to delete your account and your personal data at any time directly in the app.

This Privacy Policy does not apply to information we process on behalf of a business customer or partner acting as the controller of that information, for example where we provide services to an institution under a separate agreement. In those cases we act as a processor, and our handling of that information is governed by our agreement with that customer rather than by this policy.

2. Changes to this Privacy Policy

We may revise this Privacy Policy from time to time. If there are material changes, we will notify you by email or through the app before the change takes effect, as required by applicable law. The date at the top of this page reflects the latest revision. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use our Services after it takes effect.

3. Personal information we collect

The categories of personal information we collect depend on how you interact with us and the requirements of applicable law. We collect personal information that you provide to us, personal information we obtain automatically when you use our Services, and personal information from other sources.

A. Information you provide to us directly

Account creation and early access. When you apply for early access or create an account: your name, email address, collecting categories and interests, referral source, membership tier, time zone, preferences you set in settings, and any consents you grant or withdraw.

Photos, documents, and item information. Images and descriptive details you submit for examination. These are processed to generate your analysis and are stored in your private vault.

Assessments and analysis results. The reports, scores, provenance indicators, and valuation ranges Mavin produces for you, stored so you can review them and track your collection over time.

Purchases. If you buy a subscription through the Apple App Store, the purchase is processed by Apple and we receive transaction confirmations and subscription status. If you buy directly from us on mymavin.ai, payment is processed by Stripe, and we receive your billing details, transaction confirmations, and subscription status. In both cases we do not collect or store your payment card details, and we never ask for them.

Your communications with us. Personal information such as email address or other contact details when you request information about our Services, register for updates, apply for a job, or otherwise communicate with us.

Surveys and research. If you choose to participate in a survey or user research session, any information you provide.

Events, business development, and partnerships. Personal information collected from individuals and third parties when we attend or host events, and when we assess and pursue potential business opportunities.

B. Information collected automatically

Device and session information. Device and browser type, operating system, app version, IP address, approximate location derived from IP address, and activity timestamps.

Usage information. Information about how you use the Services, including screens or pages you visit, features you interact with, the frequency and duration of your activity, and metadata about content you provide.

Cookies and similar technologies. We and our service providers use cookies, local storage, and similar technologies ("Technologies") on our website and in parts of our Services:

• Essential Technologies are required for authentication, session management, and security. The Services will not function without them.
• Analytics Technologies are used only with your consent, managed through our consent banner, to understand how the Services are used so we can improve them. Withdrawing consent does not affect your ability to use the Services.
• We do not use advertising cookies, advertising identifiers, or cross-context behavioral advertising technologies.

You may stop or restrict Technologies through your browser or device settings, though parts of the Services may not work properly as a result. Cookie-based opt-outs may not be effective in mobile applications.

C. Information collected from other sources

We may obtain information about you from third-party services and organizations. For example, if you access our Services through an app store or a third-party login service, we may receive information from that provider consistent with your privacy settings with them.

4. How we use your personal information

If your personal information is subject to the General Data Protection Regulation, the UK General Data Protection Regulation, or the Cayman Islands Data Protection Act (as revised), our processing will be under one of the following lawful bases.

Performance of a contract. We process your personal information to carry out our contract with you or to take steps at your request before entering into a contract, including to:

• Manage your account and your information.
• Provide access to the features and functionality of the Services.
• Run AI analysis on items you submit, generate reports, and display results in your vault.
• Sync your account across your devices.
• Answer requests for customer or technical support.
• Communicate with you about your account, your activity, and policy changes.
• Administer subscriptions purchased through the App Store.

Legitimate interests. We process your personal information to further our legitimate interests, but only where those interests are not overridden by your interests or fundamental rights and freedoms, including to:

• Conduct research and development, including improving, upgrading, and enhancing the Services and developing new products and services.
• Train, evaluate, and improve the AI models that power Mavin, as described in Section 5, subject to your right to opt out. We rely on our legitimate interests and those of third parties and the wider collecting community in this processing: more accurate authentication and valuation reduces fraud and misrepresentation in cultural-asset markets, which benefits collectors, insurers, lenders, and the market as a whole, not only Runda Lab and its users.
• Maintain network and information security, detect security incidents, and protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible.
• Measure interest and engagement in the Services.
• Ensure internal quality control and safety.
• Authenticate and verify individual identities in connection with account access.
• Debug to identify and repair errors.
• Conduct audits relating to interactions and other compliance activities.
• Share information with service providers as needed to operate the Services.
• Enforce our agreements and policies.

Compliance with legal obligations. We process your personal information to comply with applicable laws, regulations, regulators, and authorities, including accounting and tax obligations and responses to lawful requests.

Consent. Where we rely on your consent, including for analytics Technologies, marketing communications, and sharing with optional partners (Section 8), you may withdraw that consent at any time. Withdrawal takes effect for future processing and does not affect the lawfulness of processing carried out before it.

Marketing. We may send you news and product updates by email where you have opted in. Every marketing email contains an unsubscribe link. You will continue to receive non-promotional service communications, such as messages about your account, security, or changes to these policies, which you cannot opt out of while you hold an account.

De-identified and aggregated information. We may use personal information and other information about you to create de-identified and aggregated information, including de-identified usage information, de-identified information about the devices from which you access the Services, analysis outcomes, scoring signals, market observations, calibration data, and other analyses we create. De-identified and aggregated information is not personal information, and we may use, disclose, and retain it as permitted by applicable law, including for research, analysis, analytics, model training and evaluation, and any other legally permissible purpose. Where we de-identify information, we maintain and use it in de-identified form, take reasonable measures to prevent re-identification, do not attempt to re-identify it, and contractually require recipients to do the same.

Where information has been de-identified and disassociated from your account, it no longer relates to you, is no longer personal information, and is retained and used independently of your account, including after your account is deleted. Information that remains linked to you is personal information and is treated as such under this policy, including for the purposes of deletion under Sections 10 and 12.

5. AI processing and model training

Mavin is an AI product, and we want you to understand exactly how your data interacts with our AI systems.

AI analysis of your submissions. When you submit photos or item details for examination, they are processed by our own systems and by third-party AI infrastructure providers acting on our behalf (see Section 7). We identify the AI providers we work with in the app when we ask your permission, and the current list of those providers is available at any time in Settings under Privacy & Data. These providers are engaged under business or enterprise terms which provide that they do not use submissions sent through their interfaces to train their own models. Under those terms a provider may retain a copy of a submission and its output for a limited period, typically up to 30 days, for security and abuse-monitoring purposes, after which it is deleted, unless we have enabled zero-retention processing with that provider or a longer period is required by law. The app discloses this and asks your permission before your first submission is sent for AI analysis.

How Mavin learns. Mavin becomes more accurate over time. To do this we use:

• De-identified and aggregated data, as described in Section 4. We use this to train, evaluate, and improve our models as a core part of operating the Services. Where this information has been de-identified and disassociated from your account, it is not personal information, and we retain and use it independently of your account, including after your account is deleted.
• Identifiable data, which you can opt out of at any time. Where your submissions remain linked to you (your photos, your documents, and your vault contents), we may use them to train and evaluate our models on the basis of our legitimate interests in improving the Services. You can opt out at any time, either through the "Help improve Mavin" control in Settings under Privacy & Data, or by emailing contact@therundalab.com and asking us to stop.

Opting out is free and takes effect for every training run assembled after we receive your request. It has no effect on your account, your vault, your access to any feature, or the price you pay. We will never close, restrict, downgrade, or degrade an account because someone has opted out, and we will not ask you to justify the request. Opting out does not remove your data from models that have already been trained, because that is not technically possible; it stops all future use.

Automated decision-making. Mavin produces AI-assisted assessments for your information. These outputs are not used by us to make decisions that produce legal or similarly significant effects concerning you. If you choose to share a report with a partner under Section 8, any decision that partner makes is the partner's own.

6. How we disclose your personal information

Service providers. We disclose personal information to third-party service providers who use it to help us operate the Services, including hosting, database and storage, authentication, AI model inference, email delivery, analytics, and customer support. These are identified in Section 7.

Payment processing. Where you purchase directly from us, your payment details are collected and processed by Stripe under its own terms and privacy notice. We receive the transaction result and billing information needed to administer your subscription and meet our accounting and tax obligations.

Affiliates. We may share personal information with members of our corporate family, including between The Runda Lab USA, Inc. and The Runda Lab Holdings Limited, for the purposes described in this Privacy Policy.

Business partners. We may share personal information with business partners to provide you with a product or service you have specifically requested, as described in Section 8.

APIs and SDKs. We may use third-party application programming interfaces and software development kits as part of the functionality of the Services. For more information, contact us as set out in Section 20.

Third-party websites and applications. If you choose to share information with, or interact with, a third-party website or application, that information becomes subject to the third party's privacy policy. We do not control and are not responsible for their processing of your personal information.

Disclosures to protect us or others. We may access, preserve, and disclose information associated with you to external parties if we, in good faith, believe doing so is required or appropriate to comply with law enforcement or national security requests and legal process, such as a court order or subpoena; to protect your, our, or others' rights, property, or safety; to enforce our policies or contracts; to collect amounts owed to us; or to assist with an investigation or prosecution of suspected or actual illegal activity.

Merger, sale, or other asset transfer. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be transferred as part of that transaction to the extent permitted by law. We will notify you of any such transfer and any resulting change to this Privacy Policy.

We do not sell your personal information. We do not currently share personal information for cross-context behavioral advertising or targeted advertising, and the Mavin app does not use advertising trackers. If this changes, we will update this Privacy Policy and provide the disclosures and opt-out mechanisms that applicable law requires before the change takes effect.

7. Third-party processors

Each service provider receives only the data it needs to perform its function, and each is contractually required to provide the same or equal level of protection for your data as set out in this Privacy Policy:

We keep this list current. If a category of provider changes materially, we will update this policy.

We identify the AI providers we work with in the app, at the point where we ask your permission to send your submissions for analysis. The current list of those providers is available at any time in Settings under Privacy & Data. We keep that list current, and if we add a provider that is not on it, we ask for your permission again before any of your submissions are sent to them.

8. Optional services at your request

We are building optional features that connect your collection to services such as insurance, lending, and marketplace liquidity. These operate only at your explicit direction:

• We share your report or vault data with a partner only when you ask us to, for example when requesting an insurance quote for a specific item.
• Each request involves a clear, per-request confirmation showing what will be shared and with whom.
• Declining or ignoring these features has no effect on the rest of the Services.
• Partner services are governed by the partner's own terms and privacy policy, which we will surface before you proceed. We are not an insurer, lender, broker, or agent of any partner.

We never share your identifiable data with insurance, lending, or marketplace partners without your explicit request. If we ever enter an arrangement that would constitute a "sale" or "sharing" of personal information under applicable law, we will update this Privacy Policy and provide the opt-out mechanisms that law requires before doing so.

9. Your privacy choices and rights

Subject to applicable law and certain limitations, you may have the right to:

• Confirm whether we are processing your personal information (the right to know).
• Access and portability: obtain access to or a copy of your personal information, receive an electronic copy of information you provided to us, or in certain circumstances ask us to send it to another company.
• Correct personal information that is inaccurate or incomplete.
• Delete your personal information. The fastest route is in the app (Section 10).
• Opt out of certain processing, including targeted advertising, the "sale" or "sharing" of personal information, and profiling in furtherance of decisions producing legal or similarly significant effects. As described above, we do not currently engage in any of these.
• Restrict or object to our processing, including where processing is based on our legitimate interests or is for direct marketing purposes.
• Limit the use and disclosure of sensitive personal information, as described in Section 14.
• Withdraw consent at any time for processing based on consent, including analytics Technologies and marketing, without affecting your ability to use the Services.
• Opt out of model training on your identifiable data at any time, through Settings or by emailing us. See Section 5. This is free, immediate for future training runs, and has no effect on your account or your access to the Services.
• Appeal a decision by us to decline to act on your request.
• Non-discrimination: we will not treat you differently for exercising any of these rights. We will not deny you the Services, charge you a different price, or provide a different level of quality because you exercised a privacy right.

A note on accuracy and our AI outputs. Mavin generates assessments by analysing the images and details you submit and predicting the most likely identification, provenance indicators, and valuation range. These outputs are probabilistic predictions, not statements of fact about you, and they may be wrong. Where an assessment records factual personal information about you that is inaccurate, you can ask us to correct it, and we evaluate every rectification request under applicable law and according to what is technically feasible. Because a model's conclusion is a prediction rather than a stored fact, correcting it is not always possible in the way correcting a stored field is; where that is the case we will tell you, and you can also use the in-app feedback route so we can review the assessment itself.

To exercise a right, use the in-app controls or email legal@therundalab.com. If you are in the European Economic Area, the United Kingdom, or Switzerland, you can instead contact our representative in your region, whose details are in Section 19. Either route reaches us and neither is slower than the other.

We respond within the timelines required by applicable law, generally within 30 days, and we may need to verify your identity first, which may include confirming the email address associated with your account. If we decline to act on your request, we will tell you why and how to appeal.

10. Deleting your account in the app

The fastest way to delete your account is inside the Mavin app:

1. Open Settings → Account.
2. Scroll to Danger zone.
3. Tap Delete account and confirm.

Deleting your account closes it permanently and cannot be undone. Once you delete your account we remove your personal information from our systems within 30 days, except where we need to retain it for longer or where it has already been de-identified and disassociated from your account. The circumstances in which information is retained are set out in Section 12.

If your subscription was purchased through the Apple App Store, deleting your account does not cancel it. Cancel in your device's subscription settings (Settings, then your name, then Subscriptions).

To export your data first, contact legal@therundalab.com before deleting and we will prepare an export.

11. International data transfers

Personal information processed by us may be transferred, processed, and stored in the United States and other countries, which may have data protection laws different from the laws where you live. Our Services are primarily hosted in the United States.

Where we transfer personal information originating in the European Economic Area, Switzerland, the United Kingdom, or the Cayman Islands to a country that has not been found to provide an adequate level of protection under applicable law, we use a valid transfer mechanism, including Standard Contractual Clauses with our processors.

Where you contact one of our representatives (Section 19), the information you provide in that request is processed on infrastructure located in the European Union and is transferred to us only to the extent needed to answer you. For more information about the safeguards we use, contact us as set out in Section 20.

12. Retention of personal information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, provide the Services, resolve disputes, establish legal defences, conduct audits, enforce our agreements, and comply with applicable law. In determining the appropriate retention period we consider legal requirements, the amount, nature, and sensitivity of the information, the risk of harm from unauthorised use or disclosure, the purposes for which we process it, and whether we can achieve those purposes by other means.

In general:

• Account and profile data: retained while your account is open.
• Photos, documents, and assessment results: retained in your vault while your account is open, or until you delete individual items.
• Activity logs and security records: generally up to 12 months, for security and fraud detection.
• Billing records: as required by accounting and tax law, typically around 7 years.
• De-identified and disassociated information: not personal information (Section 4), and retained and used independently of your account.

When you delete your account, we remove your personal information from our systems within 30 days. We may retain information for longer where:

• it has already been de-identified and disassociated from your account, including where it has entered our model development and evaluation pipelines;
• specific content or your account was restricted or banned for breaching our Terms of Service, in which case we may retain the relevant data to detect, prevent, and address fraud, abuse, and repeat violations;
• we need it to maintain the security and integrity of the Services, or to investigate or defend against actual or suspected misuse;
• we are legally required to retain it, for example on receipt of a lawful request, subpoena, or regulatory obligation;
• it forms part of financial or transaction records we retain to meet accounting, dispute-resolution, tax, and regulatory obligations; or
• it is the audit record of your deletion or other privacy request, which we keep so that we can demonstrate we complied with it.

Deleting your account does not remove your data from AI models that have already been trained. That is not technically possible. It stops any further use of your identifiable data going forward.

13. Security of personal information

We employ technical and organisational measures designed to protect the security of personal information we collect, including encryption in transit (TLS), encrypted storage, access controls, least-privilege internal access, and regular security reviews. These measures are aimed at ensuring the ongoing integrity and confidentiality of personal information, and we continue to evaluate them.

No system is perfectly secure. If you believe there has been a security incident affecting your data, contact us immediately at legal@therundalab.com. Where required by law, we will notify you and the relevant regulators of breaches affecting your personal information.

14. Supplemental notice for California residents

This section supplements the Privacy Policy and applies only to processing subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CCPA").

Categories collected and third parties to whom they are disclosed for a business purpose:

Sales of personal information. In the preceding twelve months, Runda Lab has not "sold" any personal information as defined by the CCPA, and we have no actual knowledge of any sale of the personal information of consumers under 16 years of age.

Cross-context behavioral advertising. In the preceding twelve months, Runda Lab has not "shared" any personal information for cross-context behavioral advertising as defined by the CCPA, and we have no actual knowledge of any such sharing of the personal information of consumers under 16 years of age.

Sensitive personal information. We use and disclose sensitive personal information only to perform the Services reasonably expected by an average consumer who requests them; to prevent, detect, and investigate security incidents; to resist malicious, deceptive, fraudulent, or illegal actions and prosecute those responsible; to ensure the physical safety of natural persons; and to verify or maintain the quality and safety of our Services. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you. You have the right to ask us to limit our use and disclosure of your sensitive personal information, and can do so by contacting us as set out in Section 20.

Non-discrimination. California residents have the right not to receive discriminatory treatment for exercising rights conferred by the CCPA.

Authorized agent. Only you, or someone legally authorised to act on your behalf, may make a verifiable consumer request. To designate an authorised agent, contact us as set out in Section 20 with proof of authorisation.

Verification. When you make a request, we will ask for information sufficient to reasonably verify that you are the person about whom we collected personal information, or an authorised representative, which may include confirming the email address associated with your account.

Shine the Light. California residents may request once a year, free of charge, a list of the third parties to whom we disclosed their personal information for those parties' direct marketing purposes in the prior calendar year, and the type of information disclosed. We do not currently disclose personal information for third-party direct marketing purposes.

Accessibility. This Privacy Policy was developed in line with the World Wide Web Consortium's Web Content Accessibility Guidelines, version 2.1. To print or save this policy, use your browser's print or save-as-PDF function.

15. Supplemental notice for other US state residents

If you are a resident of a US state with a comprehensive consumer privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as those laws take effect), you have the rights described in Section 9, including the rights to confirm, access, correct, delete, obtain a portable copy, opt out of targeted advertising, sale, and certain profiling, and to appeal a decision we make about your request.

We do not sell personal data, process it for targeted advertising, or use it for profiling in furtherance of decisions producing legal or similarly significant effects. If we decline to act on your request, our response will explain why and how to appeal. If your appeal is denied, you may contact your state attorney general.

16. Supplemental notice for Nevada residents

Nevada residents have the right to opt out of the sale of certain personal information to third parties who intend to license or sell that information. You can exercise this right by contacting us as set out in Section 20 with the subject line "Nevada Do Not Sell Request" and providing your name and the email address associated with your account. We do not currently sell personal information as that term is defined in Nevada Revised Statutes Chapter 603A.

17. Children's information

The Services are not directed to children or to minors. You must be at least 18 years old to use Mavin. We do not knowingly collect personal information from children. If you are a parent or guardian and believe a child has provided us with personal information, contact us as set out in Section 20 and we will promptly take steps to delete it, unless we have a legal obligation to retain it.

18. Third-party websites and applications

The Services may contain links to other websites and applications, and other websites and applications may reference or link to the Services. These are not controlled by us. We do not endorse, screen, or approve, and are not responsible for, the privacy practices or content of those websites or applications. We encourage you to read the privacy policy of each website and application with which you interact. Providing personal information to third-party websites or applications is at your own risk.

19. Complaints, supervisory authorities, and our representatives

Our representatives. Runda Lab is not established in the European Union, the United Kingdom, or Switzerland. We have appointed representatives under Article 27 of the GDPR, Article 27 of the UK GDPR, and Article 14 of the Swiss Federal Act on Data Protection. You may contact the relevant representative on all matters relating to our processing of your personal information, in addition to or instead of contacting us directly. Supervisory authorities may also address them.

When you contact a representative, they process your name, contact details, and the content of your request in order to verify it and pass it to us. They act as our processor for that purpose, using infrastructure located in the European Union, and they handle your request under their own privacy notice as well as this one. Appointing a representative does not change who is responsible for your personal information: The Runda Lab USA, Inc. remains the controller and remains accountable to you.

If you would like to make a complaint about our use of your personal information, or about our response to a request regarding your personal information, contact us as set out in Section 20.

If you are located in the European Economic Area, Switzerland, the United Kingdom, or the Cayman Islands, you also have the right to lodge a complaint with a supervisory authority if you believe our processing violates applicable law:

• EEA Data Protection Authorities: edpb.europa.eu/about-edpb/board/members_en
• Swiss Federal Data Protection and Information Commissioner: www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html
• UK Information Commissioner's Office: ico.org.uk/global/contact-us/
• Cayman Islands Ombudsman: ombudsman.ky/make-a-complaint

20. Contact us

The Runda Lab USA, Inc. 390 NE 191st St, STE 49801 Miami, FL 33179, United States Telephone: +1 212-804-8245

A subsidiary of The Runda Lab Holdings Limited, an exempted company incorporated under the laws of the Cayman Islands, registered address PO Box 10008, Willow House, Cricket Square, Grand Cayman, Cayman Islands KY1-1001.

Privacy questions, data requests, and complaints: legal@therundalab.com General enquiries: contact@therundalab.com

Email is our primary contact channel for questions, complaints, and claims.