WAPUTU PRIVACY POLICY

Waputu by Raiden Dev Stack

Version 2026-10-30

Effective date: October 30, 2026

This Privacy Policy describes how Raiden Investments LLC, doing business as Raiden Dev Stack ("Raiden," "we," "us" or "our"), collects, uses and discloses information through the waputu.com website, the Waputu application and each Waputu installation, and the public product and certificate of analysis pages published through Waputu (together, the "Service").

1. Who We Are and Our Role

Waputu is business software for cannabis businesses licensed in New Mexico (each, a "Customer"). Each Customer decides which of its employees and contractors may use the Service and what records it puts into the Service. For records a Customer puts into or connects to the Service, we process the information on that Customer's behalf and under our agreement with that Customer. If you are an employee or contractor of a Customer, questions about how your employer uses its records should go to your employer.

2. Information We Collect

2.1 Account information. Name, email address, role, permissions, the Customer you work for, and authentication information. Passwords are handled by our authentication service provider. If you use two factor authentication, we store the information needed to verify your second factor.

2.2 Signup and business information. When a business requests an account, we collect the contact name, email address, company name and other information entered in the request. During setup, we collect the company name, logo, license number, premises address and similar business information.

2.3 Customer records. Records a Customer enters into or imports into the Service, and records the Service copies from New Mexico's cannabis traceability system, NMS2S, using the Customer's credentials. These include inventory, rooms, potency, laboratory test results, event history, products, labels, ingredients and nutrition information. Transport manifest records can include driver names, the last four digits and issuing state of drivers' license numbers, vehicle descriptions, license plates or vehicle identification numbers, and the names and addresses of origin and destination businesses.

2.4 Activity and audit records. Records of actions taken in the Service, including the user, time, the action requested, and the result, including actions sent to NMS2S.

2.5 State system credentials. The NMS2S access token a Customer provides, which we store in encrypted form.

2.6 Communications. Information you send when you contact us for support or otherwise.

2.7 Technical and log information. When you use the Service, including when anyone views a public product or certificate of analysis page, our hosting and database service providers automatically log request information such as IP address, browser and device type (user agent), the page or resource requested, date and time, referring page and error information.

2.8 Billing information. We invoice Customers, and Customers pay by check or by bank transfers they initiate. We keep records of invoices and payments received, which may include the payer's name and the information shown on a check or bank remittance. We do not accept payment cards, do not use a payment processor, and do not debit Customer bank accounts. To protect the Billing page that shows our payment instructions, we send a one-time code to the email address of the owner or administrator who opens it.

3. Cookies and Similar Technologies

The Service uses cookies and browser storage that are necessary to sign you in, keep you signed in, protect your account and operate the features you use. Blocking them may prevent the Service from working. We do not use advertising cookies. We do not use third party analytics or advertising tools on the Service.

Bot protection. Our sign-in, signup and password recovery pages use Cloudflare Turnstile to check that a person, not an automated program, is using the page. To perform that check, Cloudflare collects information about your device, browser and connection under its own privacy policy.

Do Not Track. The Service does not respond to web browser "do not track" signals or similar mechanisms. We do not track you across third party websites over time, and we do not permit third parties to collect information about your online activities over time and across different websites through the Service, other than our service providers, including Cloudflare, when they process information to host, protect and operate the Service for us.

4. Public Product and Certificate of Analysis Pages

Anyone can open a public product, lot or certificate of analysis page by scanning a QR code or following a link, without logging in. We do not ask viewers for any information. Our hosting provider logs the request information described in Section 2.7. We use it to operate, secure and troubleshoot the Service, and not to identify viewers. The product information on these pages is supplied by the licensed business that made or sold the product.

5. How We Use Information

We use information to:

(a) provide, operate, maintain and update the Service, including each Customer's installation;

(b) review and approve signup requests and set up installations;

(d) generate labels, certificates of analysis, nutrition facts panels, manifests, directions and other outputs;

(e) authenticate users, enforce permissions and two factor authentication, and secure the Service;

(f) send service emails, including account, security, health and synchronization alerts to a Customer's installation owner and to our operator staff;

(g) provide support and investigate problems;

(h) bill Customers and collect payment;

(i) comply with law, legal process and requests or directives from government authorities; and

(j) enforce our agreements and protect the rights, property and safety of Raiden, our Customers and others.

6. How We Disclose Information

We do not sell, rent or share personal information or business data with anyone for money, advertising or marketing. A transfer described in paragraph (f) below is not a sale for this purpose.

We disclose information only as follows:

(a) Service providers. To companies that provide services to us so we can operate the Service, in these categories: web hosting and request logging (currently Vercel); database, authentication and file storage (currently Supabase); bot protection on sign-in and account pages (currently Cloudflare); transactional email delivery; and mapping and driving directions (currently Google), which receives origin and destination addresses from our servers when the Service prepares directions for a manifest.

(b) The State system. To NMS2S, which is operated for the New Mexico Cannabis Control Division, when a Customer's user instructs the Service to send an action, and when the Service reads the Customer's records.

(c) The Customer. Records in a Customer's installation, including activity and audit records of its users, are available to that Customer's administrators.

(d) Our personnel. Our staff and contractors may access Customer installations and the information in them to provide, maintain, update, secure and support the Service.

(e) Legal reasons. When we believe in good faith that disclosure is required by law, subpoena, court order, or a request or directive from a government authority, or is necessary to protect the rights, property or safety of Raiden, our Customers or others.

(f) Business transfers. To a buyer, successor or affiliate in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business or the Service.

(g) With consent. With your consent or at a Customer's direction.

7. Retention

We keep information for as long as a Customer's account is active and as needed to provide the Service. After a Customer's agreement ends, we keep its records for the export period in our Customer Agreement and then may delete them. Copies may remain in backups and logs until overwritten in the normal course. We may keep information longer when required by law, to resolve disputes, or to enforce our agreements. Records already sent to NMS2S are held by the state system and are not deleted by us.

8. Security

We use administrative, technical and physical measures designed to protect information, including encryption of stored NMS2S access tokens and separate installations for each Customer. No method of transmission or storage is completely secure, and we cannot guarantee security. If a security breach affects your information, we will provide the notices the law requires.

9. Your Choices and Requests

If you are an authorized user, you can review and update your account information in the Service or by asking your Customer's administrator. To request access to, correction of or deletion of personal information we hold about you, email us at the address in Section 13. We may need to verify your identity, and we may refer requests about a Customer's records to that Customer. We will respond as required by applicable law. We may keep information when the law requires or permits us to.

10. Children

The Service is for licensed cannabis businesses and their authorized adult personnel. It is not directed to anyone under 21, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

11. Where Information Is Processed

We store Customer installations with our database provider in the United States. Our service providers may process request information in other locations to deliver the Service.

12. Changes to This Policy

We may update this Privacy Policy. When we do, we will post the new version on waputu.com with a new version and effective date. If we make a material change, we will also notify Customers' installation owners by email or in the Service before the change takes effect.

13. Contact Us

Raiden Investments LLC, doing business as Raiden Dev Stack

Email: legal@waputu.com

Mail: 315 San Pedro Blvd NE, Albuquerque, NM 87108