Privacy Policy

Last Updated: August 1, 2026

We are committed to protecting your privacy. This privacy notice (this "Privacy Notice") is provided by SB Technology, Inc. d/b/a SandboxAQ ("SandboxAQ," "we", "us" or "our") on behalf of itself and its affiliates (including Cryptosense SA).

This Privacy Notice describes how SandboxAQ and its affiliates collect, use, store, share, and secure the personal data related to your use of our websites (https://www.sandboxaq.com, https://community.sandboxaq.com/, https://pub.sandboxaq.com, https://www.sandboxaq.com/solutions/drug-discovery, https://www.sandboxaq.com/solutions/material-discovery, https://www.flintai.dev/, https://www.aqtiveguard.com, https://opencryptography.com/, together, the "Websites").

The capitalized terms used in this Privacy Notice but not defined herein shall have the same meaning as defined in our Terms and Conditions. Terms such as data controller, personal data, special category data, and processing shall have the same meaning as defined in the EU General Data Protection Regulation ("EU GDPR"), and the EU GDPR as applicable as part of UK domestic law ("UK GDPR") (collectively, "GDPR").

For the purposes of applicable data protection laws, SandboxAQ is a data 'controller' and 'business' in respect of your personal data.

Employees/Job applicants: This Privacy Notice does not apply to personal data SandboxAQ collects from its employees and personnel in the context of their employment. Employees and prospective applicants should review the employee/applicant privacy notice provided separately.

If you are a California resident, please see our California Resident Privacy Notice available at www.sandboxaq.com/legal/california-resident-privacy-notice for information provided pursuant to the California Consumer Privacy Act.

This Privacy Notice is not a contract and does not create any legal rights or obligations.

The types of personal data we may collect and use

We may collect and process the following personal data about you:

(a) Information you provide to us. This might include:

• Identity data – including full name, title, gender, employment information and job title
• Contact data – including email address, telephone numbers and location data; and
• Marketing & communications data – including communication preferences.

Such information might be provided when you sign up for or use any Website, consult with our customer service team, send us an email, or communicate with us in any other way.

(b) Information that we collect automatically. We use cookies and other tracking technologies to collect some of this information. Our use of cookies and other tracking technologies is discussed more below. This might include:

• Usage data – including Website usage data; and
• Technical data – including internet protocol (IP) address, account data and device data.

(c) Information that we obtain from third parties or other sources. We may obtain information about you from third-party sources such as public websites (including social media platforms), publicly accessible databases or registers, third party data providers, and joint marketing partners.

We also note we offer a publicly accessible blog as well as other publicly accessible material such as testimonials. Please be aware that any information you provide in the blog or for a testimonial, such as your name, your company name, or any statement you make, may be read, collected, and used by others who access them. To request removal of your personal data from our blog or community forum, please contact us as described below (see "Contacting Us").

Using your personal data: the legal bases and purposes

Your personal data may be stored and processed by us for the following purposes:

• Providing you with the Websites;
• Assessing the needs of your business to determine or suggest suitable products;
• Sending requested information;
• Responding to customer service requests;
• Administering the Websites;
• Sending promotional and marketing communications and other advertising;
• Responding to your questions and concerns;
• General business administration, including communicating with clients, communicating with service providers and counterparties, the administration of IT systems, and monitoring products; and
• Compliance with legal, tax and regulatory obligations.

We are entitled to process your personal data in these ways for reasons including:

• If you are a customer, you may enter into a contract with us and some processing will be necessary for the performance of that contract or will be done at your request prior to entering into that contract. The provision of certain personal data may be necessary to provide our Services.
• Processing may be necessary to discharge a relevant legal or regulatory obligation.
• The processing will, in all cases, be necessary for the legitimate business interests of SandboxAQ, such as:
• carrying out the ordinary or reasonable business activities of SandboxAQ;
• ensuring compliance with all legal, tax and regulatory obligations;
• ensuring the security of information systems.

We may also process data where you have provided consent. For example, for marketing purposes.

Where we collect personal data to administer a contract with you or to comply with our legal obligations, this is mandatory, and we will not be able to provide our services without this information. In other cases, provision of personal data is optional, but this may affect your ability to access or use certain functionalities or services where the information is needed for those purposes.

How we may disclose your personal data

SandboxAQ does not sell your personal data. We may "share" your personal data (as that term is defined under the CCPA — i.e., disclosures for cross-context behavioral advertising). If you are a California resident, you can opt out of this sharing as described in our California Resident Privacy Notice.

We may from time to time, in accordance with the purposes described above and as permitted by applicable law, disclose your personal data to other parties, such as affiliates of SandboxAQ or sub-contractors and service providers we use to help us provide our Websites. Some of these persons will process your personal data in accordance with our instructions and consistent with this Privacy Notice. These persons may be permitted to further disclose the personal data to other parties as permitted by applicable law. We may also disclose your personal data to any other third party with your prior consent.

In the event SandboxAQ goes through a business transition, such as a merger or acquisition by another company, or sale of all or a portion of its assets, your personal data will likely be among the assets transferred.

Cookies

When you use our Websites, we may store some information on your computer. This information will be in the form of a "cookie" or similar file/technologies. Cookies are small pieces of information stored on your hard drive, not on the Website.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of the Websites. They include, for example, cookies that enable you to log into secure areas of the Website.
• Analytical or performance cookies. These allow us to recognize and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way the Websites work.
• Functionality cookies. These are used to recognize you when you return to our website. This enables us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed, and your interactions with the Websites’ social media features (such as the Facebook "Like" button). We may share this information with third parties for this purpose. Your interactions with these features may be governed by the privacy policy of the company providing them. We have no control over the use or governance of these cookies.

We use cookie technology to improve your experience navigating the Websites. You can choose which analytical, functionality and targeting cookies you consent to – the cookies will not be used without your consent. If you disable or refuse cookies, please note that some parts of the Website may become inaccessible or not function properly.

Online privacy and tracking technologies

By visiting our Website or engaging with us via email, we may collect personal data about you. We use technologies such as web beacons in analyzing trends, administering the Websites, tracking users’ movements around the site, and gathering demographic information about our user base as a whole. We may receive reports based on the use of these technologies by these companies on an individual and aggregated basis. We gather certain information automatically and store it in log files. This information may include internet protocol (IP) addresses, browser type, internet service provider (ISP), and other device information. We link this automatically-collected data to other information we collect about you.

Links to other websites

The Website may include links to other websites maintained by third parties that are not owned or controlled by SandboxAQ. This Privacy Notice is limited to our own information collection practices, and we are not responsible for the privacy or information collection practices of other websites. We encourage you to be aware when you leave or are redirected from our Websites and to read the privacy policies of any linked website.

International data transfers

SandboxAQ is headquartered in the United States and works with customers and partners globally. Most of the personal data is hosted on IT systems in the US. Your personal data may be transferred to or remotely accessed by our affiliates or service providers in other countries including the US and Canada that may not have a similar level of data protection or privacy laws as the country where you live. We take measures to protect your personal data in transit and wherever it is stored.

Where we transfer your personal data outside your home country, we will take steps to ensure that your personal data is protected as required under applicable data protection law (including, where appropriate, under an agreement on terms approved for this purpose by the European Commission or the relevant government or supervisory authority, as the case may be, such as the EU Standard Contractual Clauses or the UK Addendum to the EU Standard Contractual Clauses).

You can obtain more details of the protection given to your personal data (including a copy of the relevant mechanism relied on) when it is transferred outside of your home country by contacting us using the details set out under "Contacting Us" below.

Retention of personal data

How long we hold your personal data for will vary. The retention period will be determined by various criteria, including the purposes for which we are using it. We generally retain personal data we process for as long as needed to provide the Website or as required by legal or regulatory obligations.

Where we process personal data for marketing purposes or with your consent, we retain the data until you ask us to stop and for a short period afterwards (to allow us to implement your request). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that we can respect your request in future.

If you wish to request that we no longer use your data, please contact us by using the details set out under "Contacting Us" below.

Your rights

Depending on your jurisdiction, you may have a number of legal rights in relation to the personal data that we hold about you. These rights include the following:

• The right to obtain information regarding the processing of your personal data and access to the personal data that we hold about you.
• In some circumstances, the right to receive some personal data in a structured, commonly used and machine-readable format and the right to request that we transmit that data to a third party where this is technically feasible. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• The right to withdraw your consent to our processing of your personal data where we are relying on consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent. To stop receiving newsletters or marketing communications from us, you can use the unsubscribe mechanism in the relevant communication or you can send an email to privacy@sandboxaq.com with information necessary to process your request. Please note that this will not stop you from receiving service-related messages (i.e., non-marketing communications).
• The right to request that we rectify your personal data if it is inaccurate or incomplete;
• The right to request that we erase your personal data in limited circumstances. Please note however that there may be circumstances where you ask us to erase your personal data but we are legally entitled to retain it or such erasure is prohibited by law;
• The right to object to, and the right to request that we restrict, our processing of your personal data in certain circumstances. Please note that there may be circumstances where you object to, or ask us to restrict, our processing of your personal data but we are legally entitled to continue processing your personal data and/or to refuse that request. You have the absolute right to opt out of our direct marketing at any time, and EEA and UK individuals can also opt out of profiling we carry out for direct marketing at any time.

We do not carry out any solely automated decision making, including profiling, which has a legal or similarly significant effect on you.

You can exercise your rights by completing the Data Subject Access Request form or contacting us by using the details set out under "Contacting Us" below. We may ask you to verify your identity to help us respond efficiently to your request.

You also have the right, at any time, to lodge a complaint about our processing of your personal data with the relevant EU or UK body regulating data protection in the country where you live, work or you believe a breach may have occurred. In the UK, you also have the right to complain to us. The data protection authority in the UK is the UK Information Commissioner’s Office, and a list of the EU data protection authorities and contact details is available at Our Members | European Data Protection Board.

Our websites are not intended for children

Our Websites are meant for adults. We do not knowingly collect personal data from children under 18. If you are a parent or legal guardian and think your child has given us information, you can contact us by using the details set out under "Contacting Us" below.

We use standard security measures

We value the security of your data and take reasonable measures to keep your data secure, but we cannot promise that your use of our Websites will be completely safe. Any transmission of your data to us or our Website is at your own risk. We encourage you to use caution when using the Internet.

We may update this Privacy Notice

We may update this Privacy Notice from time to time, and we will review it at least annually. We will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

Contacting Us

If you would like further information on our privacy policy, or practices, please contact us at privacy@sandboxaq.com.

Last Updated: August 1, 2026