Privacy Policy

1. Who is responsible

Broodex, Inc, a Wyoming domestic profit corporation, operates Cybercab Collective's prelaunch Website and determines the purposes and means of the personal-information processing described here. Our postal contact is 30 N Gould St Ste R, Sheridan, WY 82801, USA, Attn: Cybercab Collective Privacy. Email: [email protected]. Filing ID: 2015-000694210.

This policy covers the interest register, associated Website, preference controls and project communications described here. It does not describe a live investment account, payment service, operating fleet, Tesla's systems or another company's website. A separate privacy notice will address materially different future services before they begin. Regional rights are explained in the U.S. State Privacy Supplement and EEA/UK Privacy Supplement.

2. Information we collect

Contact and inquiry information: the name and email you submit; country of residence, U.S. state where applicable and current location where a form requests it; selected vehicle equivalents or approximate budget; your interpretation of that budget; preliminary accreditation or entity self-assessment; other limited questionnaire answers; and correspondence you send us. Avoid sensitive details in free-text messages.

Financial-institution inquiries: if you choose that form option, we collect the professional contact and organization information you supply, including the institution's name and type, financing-program readiness, financing focus, indicative U.S.-dollar range per deal, lending coverage, and optional market details and public website. Contact information includes the representative's name, email, residence country and region where requested. These answers describe potential financing-partner interest, not an individual borrower's application or creditworthiness. The contact supplies this information voluntarily on the institution's behalf; do not provide client identities, credit reports, financial documents or confidential borrower information.

Optional phone and SMS information: if you provide a mobile number, we store its normalized international format and country, along with your separate important-milestone SMS choice. A number may be provided without granting SMS permission. We record the relevant policy version, number and country, choice, date, and subsequent confirmation, change or withdrawal events. The number is unverified: checking its format or confirming your email does not establish phone ownership. SMS sending and phone verification are not enabled, and no text is sent by this Website. The number is optional for all registration types. See the Email and SMS Terms for the limited milestone purpose and current controls.

Website and security information: network requests expose an IP address and ordinary browser/request information to the infrastructure serving them. The application uses protected, hashed identifiers for abuse limits and records limited error, access and administrative events. An optional local MaxMind database suggests a country from the network address without sending it to a geolocation service or saving the raw address in your registration. You can correct the suggestion; only the country you submit is saved. We do not intentionally collect precise GPS location or create a browser fingerprint for marketing. No optional analytics, advertising or session replay is enabled.

Consent and administration records: the terms and notice versions presented, affirmative choices, submission and verification events, withdrawal and suppression records, access and deletion requests, and limited evidence needed to document compliance and prevent abuse.

We do not request birth dates, Social Security numbers, passport copies, identity scans, bank or investment statements, credit reports, tax returns, accreditation evidence, payment credentials, wallet addresses, private keys, seed phrases, health information or biometrics through the lead form. Do not send them. Unnecessary sensitive information received inadvertently will be restricted and deleted where appropriate and lawful.

3. Sources

We receive information directly from you, from your browser or device, and from hosting, security and email-delivery providers acting for us. SMS delivery, optional analytics, advertising and external consent-management services are not currently enabled. Optional phone and SMS choices come directly from you, not from Twilio or a phone-verification provider. We do not buy investor lead lists for this register or obtain financial dossiers from data brokers.

If a person refers someone else to the project, we ask the referred person to submit their own details. We do not treat a referral as the referred person's marketing consent. A referral code entered manually or applied through a valid link is saved with the first registration. A signed first-party cookie remembers the first active referral link for up to 30 days and prevents editing its code while it remains valid. The code owner can see aggregate registration and verified-email totals, not your name, email or individual record. Withdrawn or deleted records are excluded from those totals. Influencer account owners provide their name and sign-in email. Later regulated verification would require a separate explained process, rather than an undisclosed expansion of this collection.

4. Purposes and legal bases where required

Interest administration: we use contact details, answers and selected amounts to record nonbinding interest, verify submissions, handle requested corrections and assess whether there is demand for the proposed project. Where a legal basis is required, we generally rely on our legitimate interests in administering a requested inquiry and avoiding misleading demand figures, subject to the individual's rights. We use contract necessity only for processing objectively needed to perform the limited Website arrangement, not as a blanket basis for marketing.

Financing-partner inquiries: we use the institutional profile and business-contact answers to understand potential financing-program readiness, assess possible fit for future discussions and administer the inquiry and communications requested by that contact. Where a legal basis is required, this relies on our legitimate interests in handling the requested business inquiry, subject to individual rights; optional promotional messages require the applicable separate permission. We do not use this form to obtain a credit report, underwrite a borrower, approve financing or transmit investor profiles to institutions as financing applications. Institutional inquiries are excluded from modeled investor vehicle and capital totals, and an indicative deal range is not recorded as a capital commitment. Where a referral applies, institutional inquiries are included in aggregate registration and verified-email counts on the same basis as other registrations; this does not count them as investors or committed funding.

Requested readiness contact: with your specific choice, we retain your request and send an investment-readiness email when an appropriately documented proposal is available and sending it is legally permitted. For a financial-institution inquiry, the requested contact concerns a potential future financing-partner discussion. We treat that permission as consent where required and honor withdrawal. A request does not establish investment or financing eligibility.

Optional communications: the two email choices and important-milestone SMS choice are separate. With the SMS choice, you request automated marketing texts from Cybercab Collective about important milestones, such as a future sales launch, rather than routine promotional messages. We currently store the number and choice to administer this request; SMS delivery is not active. A voluntarily supplied number without SMS permission is a contact detail for your inquiry and preference record, not permission to call or text. Where required, consent is the basis for the optional marketing purpose. Declining a channel does not authorize another, and you may remain in the interest register without a phone number or optional promotions.

Security and compliance: we use proportionate technical and administrative information to secure systems, detect duplicate or abusive submissions, manage access, honor preferences, handle disputes and document compliance. We rely on legitimate interests or a specific legal obligation where applicable. We do not describe every possible compliance activity as legally mandatory.

Optional measurement and advertising: these services are not enabled. If introduced, we will explain the actual services and purposes and provide the required choices before processing begins. Our intended default is prior opt-in for nonessential analytics and advertising, plus applicable opt-out controls. We do not send form answers, investment amounts, accreditation status, names, emails, phone numbers or verification tokens to advertising services or session-recording tools.

Business planning: we may use genuinely aggregated or de-identified information to evaluate demand, such as counts by broad region and indicated ranges, with measures designed to prevent re-identification. We do not attempt to re-identify data we have represented as de-identified, except lawful testing of the safeguards.

5. Who may receive information

Authorized personnel and service providers may access only the information reasonably necessary for hosting, databases, security, communications, customer support, consent management and professional services, subject to appropriate instructions, confidentiality and applicable contracts. Our current provider and processing-location register is available at provider register.

Twilio is a planned SMS delivery provider, not an active recipient of Website phone numbers or SMS consent records. Authorized staff and the hosting/database infrastructure can access submitted numbers as needed for the requested register and preference controls. We do not sell, rent or transfer phone-based marketing permission to unrelated senders. Any future delivery provider will receive only the information needed for the disclosed purpose after appropriate setup and safeguards.

Professional advisers, insurers and legal authorities may receive relevant information when reasonably necessary for advice, a lawful request, legal obligations, protection of rights or investigation of suspected wrongdoing. Disclosures are limited according to the purpose and applicable law.

No advertising or optional measurement provider receives information through the current Website. If such a service is introduced, its role, information received and purposes will be identified in the Cookie Policy and provider register before it is enabled with the required choices. A provider acting for its own purposes will not be described solely as our processor.

We do not sell or rent the investor-interest contact list to lead brokers, vehicle manufacturers or unrelated marketers. We do not currently use advertising disclosures that constitute sale, sharing or targeted advertising. In some jurisdictions, such disclosures of online identifiers or browsing activity can fall within these definitions even without a cash payment. Your Privacy Choices explains the current state and how to contact us about your rights. Any future covered activity would require the applicable choices before it begins.

6. A future corporation or project transfer

A separate corporation may later operate the fleet proposal. Before moving identifiable leads to a new controller, we will assess the lawful basis and purpose compatibility, provide required information about the recipient and obtain fresh permission where needed. We will not use a generic "affiliates" clause to authorize unrelated robotics marketing or silently transfer SMS permission to an unidentified sender.

A genuine merger, reorganization, financing diligence or sale of the relevant business may involve limited data review or transfer under appropriate confidentiality and legal safeguards. Existing choices and legally required notices will be respected. A transfer is not an investment, does not make you a shareholder and does not excuse compliance with deletion, objection or suppression obligations.

7. Cookies, advertising and similar technologies

The current Website uses first-party technologies for requested access, authentication and referral attribution. The Cookie Policy lists their actual names, purposes and lifetimes. No optional analytics, advertising, session replay or third-party tracking scripts are enabled. The calculator and interest register do not require consent to optional tracking.

Cookie Settings opens the active inventory and explains browser controls. Your Privacy Choices explains how to exercise applicable rights without opening an account. There are currently no optional tracking categories to enable or covered advertising disclosures to opt out of; a Global Privacy Control signal does not enable any tracking. If covered activities are introduced, the required consent and opt-out controls, including applicable Global Privacy Control handling, will be implemented before they begin. Ordinary "Do Not Track" settings are not affirmative consent.

We do not place advertising pixels, session replay or third-party financial profiling on the interest questionnaire, its confirmation pages, preference pages or any later sensitive verification process. We do not upload this lead list for custom audiences, enhanced conversions or lookalike targeting under this policy. New uses would require separate review and appropriate notice and permission.

8. Retention

Unverified submissions are normally deleted after seven days. Verified interest records are ordinarily kept for up to 730 days, approximately 24 months, from your last substantive interaction unless you withdraw sooner or a lawful reason requires a different period. Merely receiving or opening a promotional email does not automatically restart this period. Withdrawn lead profiles are ordinarily deleted after 90 days. These lead-profile periods also apply to an optional stored phone number and its current SMS choice. We may ask for a fresh expression of interest before keeping an inactive lead longer; silence is not renewed consent.

Expired access tokens, authentication sessions and abuse-limit records are removed through the retention process. Sent, failed or cancelled email-queue records are ordinarily removed after 30 days. Consent and scenario history associated with a deleted lead is also deleted, including associated historical SMS choices and recorded numbers. Changing or removing the current number does not itself erase prior consent evidence; privacy deletion requests are handled under the applicable rights and retention rules. Relevant incident records may be retained longer when reasonably necessary. Routine infrastructure-log and backup retention depend on the configured services; the provider register identifies configuration status, and the deployed schedules and locations must be recorded before public use. This policy does not represent that an unconfigured backup or log schedule is already operating. Deleted records must not be restored to active marketing lists.

Minimized suppression hashes, administrative audit records, privacy-request correspondence and other justified compliance records are governed separately from active lead profiles. The application does not automatically expire every such record; their necessity is periodically reviewed, and they are restricted from unrelated use. We retain only what is reasonably needed to honor opt-outs, document choices, meet applicable obligations or establish or defend claims. A specific legal hold or mandatory retention requirement can extend the relevant record's period, but does not authorize renewed marketing.

9. Your choices and rights

You can update or withdraw an expression of interest, unsubscribe from readiness or update emails, change or remove an optional phone number, withdraw milestone-SMS permission, inspect or remove cookies, and contact us about personal information. Depending on applicable law, you may have rights to access, correction, deletion, portability, restriction, objection, withdrawal of consent, or review of certain automated decisions. Additional state rights may include opting out of sale, sharing, targeted advertising or specified profiling and appealing a denial. See the regional supplements.

Request assistance through [email protected] or Your Privacy Choices. We will not require an investment, fee or new account to submit a request. We may verify identity proportionately before disclosing or changing protected records, but will not request unnecessary sensitive documents. Authorized representatives may be used where permitted by law. We do not discriminate against a person for exercising protected rights.

Valid secure preference links do not require a login. You can also manage supported interest, phone and communication choices by signing in to your account, or send a privacy or marketing opt-out request by email without creating an account. Changing or removing a phone number revokes its previous SMS permission; a new number needs an explicit new choice. Withdrawing interest turns off all optional communication choices. SMS sending and a STOP/HELP inbox are not currently enabled; working reply controls and sender information will be provided before sending begins. Withdrawing consent does not retroactively invalidate lawful processing before withdrawal. Some information may need to be retained for a lawful reason; we will explain an applicable refusal or limitation where required.

10. International processing

Broodex is established in the United States. Data may be processed in the United States and the locations identified in the current provider register, which may have different privacy laws. Where restricted-transfer rules apply, the relevant transfer must use a valid mechanism, such as an applicable adequacy decision or approved contractual safeguards with required assessments and supplementary measures.

We do not claim that Broodex is certified under a data privacy framework unless a verified certification is expressly published. Accepting these Website terms is not a blanket consent to all international transfers or a waiver of data-protection rights. Contact [email protected] for information about applicable safeguards and an appropriately redacted copy when required.

11. Security and automated processing

We use administrative, technical and organizational measures appropriate to the risks, including controlled access, protected transmission, proportionate logging and service-provider controls. No internet service can guarantee absolute security. Do not send confidential financial or identity documents by ordinary contact form or email.

Basic routing may use self-reported location, choices and security signals. We do not use this lead-stage process to make a binding automated investment decision, approve credit, or assign a verified financial qualification. A person can request review of an apparent routing error. Any future legally significant automated decision or additional profiling would require a separate assessment and notice.

12. Adults, links and changes

The interest register is not intended for anyone under 18, and we do not knowingly maintain under-18 lead profiles. Contact us if you believe a minor has submitted information so we can address it. Third-party websites and platforms have their own privacy practices; this policy does not govern them.

We will update this policy to reflect material changes and provide notice before materially incompatible processing or obtain new consent where required. The effective date is September 7, 2026; the separately displayed version identifier distinguishes revisions and recorded acceptance. A policy update cannot silently expand optional marketing permissions or remove a mandatory right. Questions, complaints and privacy requests may be directed to [email protected] or the postal contact above.