SpareBox Technologies Privacy Policy

Effective Date: August 12, 2026  •  Last Updated: August 12, 2026

This privacy policy (“Privacy Policy”) describes how SpareBox Technologies, LLC (“SpareBox”, “we”, “our”, or “us”) collects, uses, processes, retains, and discloses personal information about you, and your data privacy rights. Personal information means any information that directly or indirectly identifies you or is reasonably capable of being associated with you. Personal information does not include information about organizations, or de-identified or aggregated data that is not capable of identifying you.

This Privacy Policy applies within the United States to the SpareBox website at spareboxtech.com (the “Site”) and to the SpareBox Services, including the RaFA mobile application and its web interface SnapShot, BigFoot, Prophet, and SeRUM (collectively, the “Services”). It applies to personal information we collect from: (1) self-storage facility owners and operators who subscribe to or evaluate the Services (“Operators”); (2) the personnel and Authorized Users of Operators; (3) prospective customers and Site visitors; and (4) our business-to-business contacts, such as partners, service providers, and contractors (“B2B Contacts”).

When we provide the Services to an Operator, we also process personal information about that Operator’s own customers and tenants (“Operator Customer Data”) on the Operator’s behalf, acting as the Operator’s “service provider” or “processor.” Our processing of Operator Customer Data is governed by our agreement with the Operator, and the Operator’s own privacy policy — not this Privacy Policy — governs how that Operator handles its customers’ information. This Privacy Policy describes our own practices as a “business” or “controller.”

This Privacy Policy does not apply to our employees or job applicants. We may provide separate or additional privacy notices for collection practices not within the scope of this Privacy Policy, in which case those notices will apply. We may change this Privacy Policy from time to time to reflect changing legal, regulatory, or operational requirements; if we make material changes, we will revise the dates above and, where appropriate, provide additional notice. Your continued use of the Services after changes take effect constitutes acceptance to the extent permitted by applicable law.

1. Collection and Use of Personal Information.
   1. Information You Provide to Us. We collect personal information you provide directly to us. If you are an Operator or an Authorized User who registers for, evaluates, or uses the Services, you may provide your name and business contact information (such as company name, business email, telephone number, and address) and the Login Credentials used to access the Services. You may also submit content through the Services, such as photographs, videos, messages, and task and property information uploaded through RaFA or SnapShot. If you are a B2B Contact, you may provide your name and business contact information so that we can conduct our business relationship. When you otherwise communicate with us, we collect your messages and contact information in order to respond.
   2. Information We Collect Automatically. We and our service providers automatically collect certain information about your interactions with the Site and the Services, including product interactions and other usage information, device identifiers, crash data, and performance data. On the Site, we and our providers may use cookies and similar technologies to operate the Site, remember your preferences, and understand usage.
   3. Information We Collect From Other Sources. We obtain personal information from other sources, including from Operators and from the third-party services integrated with the Services (such as a Property Management System or SpareFoot), and from analytics providers. We use this information to provide, secure, and improve the Services.
   4. Operator Customer Data We Process for Operators. We receive and process Operator Customer Data on behalf of, and at the direction of, Operators in order to provide the Services. Operators are responsible for ensuring that their provision of Operator Customer Data to us complies with applicable privacy laws, including providing any required notice to, and obtaining any required consent from, their customers and tenants. We process Operator Customer Data only to provide the Services and for no other purpose, and we do not sell or share it.
   5. Information We Derive. We may derive personal information or draw inferences from the information we collect or receive, for example to provide, personalize, and improve the Services.
   6. Artificial Intelligence; Automated Processing. Certain Services use artificial intelligence and machine-learning models (“Models”). The Models may learn from an Operator’s own portfolio in order to provide the Services to that Operator. We may de-identify, anonymize, and aggregate information so that it does not identify any individual, Operator, or Authorized User (“De-Identified Data”), and may use De-Identified Data to operate, improve, and develop the Services and our products generally, including to train and improve the Models. We do not attempt to re-identify De-Identified Data. We do not use Models to make decisions that produce legal or similarly significant effects concerning an individual, such as decisions regarding financial or lending services, housing, insurance, education, employment, health care, or access to essential goods or services. We will not use an Operator’s identifiable data to obtain a competitive advantage against the Operator, to solicit its tenants or customers, or to provide insights derived from that data to a competitor of the Operator.
   7. Additional Uses. In addition to the purposes described above, we may use personal information to: (i) provide, operate, secure, and support the Services, authenticate users, and prevent fraud; (ii) monitor, analyze, and improve the performance, reliability, and scalability of the Services and develop new features; (iii) communicate with you, including service, security, and administrative messages; (iv) detect, investigate, and prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity, and debug and repair errors; and (v) comply with our legal and financial obligations and as otherwise permitted or required by law.
2. Disclosure of Personal Information. We may disclose personal information in the following circumstances:
   1. Personnel. To our personnel who have a need to process it to perform their duties.
   2. Service Providers and Subprocessors. To vendors that provide services to us, such as cloud hosting providers, analytics providers, artificial-intelligence and model providers, and support and bug-tracking providers, in each case under obligations of confidentiality and limited use. Such providers do not use the information to train their own generally available models.
   3. Integration Partners. To the third-party services with which the Services integrate at Operator’s direction, such as a Property Management System or SpareFoot, as necessary to provide the Services.
   4. Legal and Safety. Where we believe disclosure is required by law or legal process, or necessary to protect the rights, property, or safety of SpareBox, our users, or others.
   5. Advisors. To our lawyers, auditors, and other professional advisors where necessary to obtain advice or protect and manage our business.
   6. Change of Ownership. In connection with, or during negotiations of, any merger, financing, acquisition, or sale of all or a portion of our business or assets.
   7. De-Identified and Aggregated Information. We may disclose De-Identified Data and Aggregated User Data that cannot reasonably be used to identify you, and we commit to maintain and use such information only in de-identified or aggregated form and not to attempt to re-identify it except as permitted or required by law.

We do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we do not engage in targeted advertising.

3. Protection and Retention of Personal Information. We take steps to protect personal information with appropriate physical, administrative, organizational, and technical safeguards. However, no system is completely secure, and we cannot guarantee absolute security. We retain personal information for as long as necessary to carry out the purposes for which it was collected and for other legitimate business purposes, including to meet our legal, regulatory, and compliance obligations. We generally retain the personal information of Operators, Authorized Users, and B2B Contacts for as long as we have a continuing relationship and for up to three (3) years thereafter, unless a longer period is required by law. If you delete content within the Services, it will be removed from active systems and from backups within a reasonable period.
4. Sensitive Personal Information. Under some U.S. privacy laws, certain personal information is considered “sensitive.” The only category we handle that may be considered sensitive is Login Credentials, which we use solely to authenticate users and secure the Services, and not to infer characteristics about an individual. Because we use this information only for these limited and permitted purposes, we do not offer a right to limit the use of sensitive personal information.
5. Cookies and Your Choices. Most web browsers accept cookies by default. You can usually adjust your browser settings to remove or reject cookies, although doing so may affect the availability and functionality of the Site.
6. Children. The Services are intended for self-storage operators and their personnel and are not directed to children under the age of 18. We do not knowingly collect personal information from children under the age of 18, and we do not knowingly sell, share, use for targeted advertising, or otherwise disclose the personal information of children under the age of 18.
7. Opt-Out Preference Signals and “Do Not Track”. We honor opt-out preference signals, including the Global Privacy Control (GPC), as valid requests to opt out of the sale or sharing of personal information for the browser or device from which the signal is sent, to the extent required by applicable law. Because there is no common standard for interpreting browser “Do Not Track” signals, we do not currently respond to them; however, we honor opt-out preference signals as described above.
8. Your U.S. State Privacy Rights. Residents of states that have enacted comprehensive consumer privacy laws — including California, Colorado, Virginia, Connecticut, Texas, Oregon, Montana, and other states whose laws are or become effective — may have some or all of the following rights, subject to the exceptions and verification requirements of the applicable law:
   1. Right to confirm, know, and access — to confirm whether we process your personal information and to access the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes, and the categories of third parties to whom we disclose it.
   2. Right to correct — to request correction of inaccurate personal information.
   3. Right to delete — to request deletion of personal information we have collected.
   4. Right to portability — to obtain a portable copy of your personal information, to the extent technically feasible.
   5. Right to opt out of sale or sharing and targeted advertising — although we do not sell or share personal information or engage in targeted advertising.
   6. Right to limit the use of sensitive personal information — see Section 4 regarding our limited handling of sensitive personal information.
   7. Right to opt out of profiling — in furtherance of decisions that produce legal or similarly significant effects; we do not engage in such profiling.
   8. Right to a list of third parties — where provided by applicable law, to receive a list of the third parties to which we have disclosed personal information.
   9. Right to non-discrimination — we will not discriminate against you for exercising any of your rights.
   10. Right to appeal — where provided by applicable law, to appeal our decision on your request.
   11. How to Exercise Your Rights. You may exercise your rights by emailing us at support@spareboxtech.com. We may need to verify your identity before responding, and may ask you to provide information relating to your interactions with us. We will respond within the time required by applicable law (generally 45 days, subject to extension as permitted), and will act on opt-out requests within 15 business days. If we process personal information about you as a service provider or processor on behalf of an Operator, we will direct your request to that Operator.
   12. Appeals. If we decline to act on your request and the applicable law provides a right to appeal (for example, in Colorado, Virginia, and Connecticut), you may appeal by replying to our response. Within the period required by applicable law, we will inform you in writing of the action taken and the reasons. If we deny your appeal, you may contact the Attorney General or applicable regulator in your state.
   13. Authorized Agents. Where permitted by applicable law, you may use an authorized agent to submit a request on your behalf. We may require evidence of the agent’s authority, such as a power of attorney or other valid written authorization, and may require you to verify your identity directly.
9. Additional U.S. State Disclosures.
   1. Categories of Personal Information. In the preceding 12 months, we have collected the following categories of personal information, for the business and commercial purposes, and disclosed them to the categories of recipients, described below:

Category of Personal Information	Business or Commercial Purpose	Categories of Recipients
Identifiers (e.g., name, business email, phone, address, account and device identifiers)	Provide, secure, and support the Services; authenticate users; communicate; legal compliance	Service providers and subprocessors; integration partners; advisors; as required by law
Account and login information, including Login Credentials (sensitive)	Authenticate users and secure the Services	Service providers and subprocessors; as required by law
Commercial and customer-records information (e.g., billing and subscription information)	Administer subscriptions and billing; provide the Services; legal compliance	Service providers and subprocessors; advisors; as required by law
Content you provide (e.g., photographs, videos, messages, task and property information)	Provide the features you choose to engage within the Services	Service providers and subprocessors; integration partners; as required by law
Internet or network activity (e.g., product interactions and usage information)	Operate, analyze, and improve the Services; security	Service providers and subprocessors; as required by law
Device and diagnostics data (e.g., device identifiers, crash and performance data)	Operate, secure, debug, and improve the Services	Service providers and subprocessors; as required by law
Professional or employment information (for Operator personnel and B2B Contacts)	Conduct our business relationship; provide the Services	Service providers and subprocessors; advisors; as required by law
Inferences drawn from the above	Provide, personalize, and improve the Services	Service providers and subprocessors; as required by law

10. Changes to this Privacy Policy. We may update this Privacy Policy from time to time. If we make material changes, we will revise the dates above and, where appropriate, provide additional notice through the Services or by other means before the changes take effect.
11. Contact Us. If you have questions or concerns about this Privacy Policy or our privacy practices, contact us at: support@spareboxtech.com; SpareBox Technologies, LLC, 7887 E Belleview Ave, Suite 650, Greenwood Village, CO 80111, United States.