# Dropair Global Privacy Policy

**Legal Entity:** DROP AIR K.K.\
**Last Updated:** April 1, 2026\
**Applies to:** Dropair ID, Dropair applications, websites, Client System, Firmware Online, Dropair Cloud, Dropair Climate, connected Dropair products, technical support, dealer/installer services, and other services that link to this Privacy Policy (collectively, the **“Services”**).

> **Important:** This is Dropair's global privacy notice. Certain countries or regions may provide additional mandatory rights or requirements. Where applicable law gives you rights or protections that are more favorable than this Policy, those rights and protections apply.

---

## 1. About This Privacy Policy

DROP AIR K.K. ("Dropair," "we," "us," or "our") respects the privacy of customers, users, dealers, distributors, installers, contractors, project participants, website visitors, and other individuals who use or interact with our Services.

This Privacy Policy explains what information we collect, where it comes from, why and how we use it, how connected products and Dropair Climate process environmental and operational data, when information may be shared, how international transfers are handled, how long information may be retained, how we protect information, your privacy rights and choices, and how to contact us.

This Policy should be read together with the applicable **Dropair Terms of Use and Sales Conditions**, product documentation, and any additional privacy notice presented for a specific Service or feature.

## 2. Who Is Responsible for Your Information

The primary operator of the Dropair ID system and the Services covered by this Policy is **DROP AIR K.K., Japan**.

Depending on the transaction or Service, a Dropair affiliated company may also process information as a service provider, processor, independent controller/business, joint controller, seller, or other legally recognized role. Where another Dropair entity has separate legal responsibility for particular processing, we may identify it in the relevant Service, transaction document, contract, or supplemental privacy notice.

## 3. Scope

This Policy applies to information processed through or in connection with Dropair ID; Dropair mobile and web applications; Dropair Client System; Firmware Online; Dropair Cloud; Dropair Climate; connected Dropair controllers, gateways, adapters and sensors; device commissioning and management; firmware and software licensing; dealer, distributor and installer portals; quotations, orders and after-sales service; product registration; technical support; websites and online forms; and future Dropair Services that link to this Policy.

Third-party products, platforms, applications, payment services, shipping providers, smart-home ecosystems, identity providers and websites may have their own privacy policies. This Policy does not replace the notices of independent third parties.

## 4. Categories of Information We May Collect

The information we collect depends on the Services, products and features you use.

### 4.1 Dropair ID and Account Information

We may collect name, email address, Dropair internal user identifier, organization/company name, country or region, language and locale, account roles and permissions, account creation and verification status, authentication provider information, account security events, Terms and Privacy Policy version records, consent or acknowledgement records where applicable, and account/login timestamps.

We do not store plaintext passwords. Password-based authentication credentials are protected using appropriate security mechanisms.

### 4.2 Sign in with Apple and Other Identity Providers

If you use Sign in with Apple, we may receive a provider-specific stable account identifier, your name when Apple makes it available, your email address, or an Apple private relay email address if you choose Hide My Email. Dropair may associate this identity with your Dropair ID.

We do not require you to disclose your underlying personal email solely because you use an Apple private relay address, unless a separate business purpose requires another contact address and we clearly request it.

### 4.3 Organization and Business Information

For business accounts we may process company name, business address, business contact information, job title or role, dealer/distributor/installer status, assigned customers, Sites or projects, permissions, quotations, commercial terms, order history and business communications.

### 4.4 Transaction and Order Information

We may collect quotation information, products and quantities, billing and shipping information, destination, payment status, currency, invoice/order identifiers, customs or shipping information, warranty information, returns/repair information and transaction communications.

Payment credentials may be processed directly by payment providers or financial institutions. Dropair may receive transaction confirmations, status information and limited payment-related identifiers rather than complete payment credentials.

### 4.5 Device and Product Information

Connected products may provide device identifiers, model, hardware revision, firmware/software version, serial number where applicable, Matter or other smart-home configuration information where applicable, network/connectivity status, capabilities, configuration, commissioning status, device health, uptime, diagnostics, fault codes, command history and update status.

### 4.6 Site, Home, Room and Installation Information

We may process Site/Home name, room and zone names, country or region, Site time zone, building or installation characteristics, HVAC system information, equipment models, wiring/configuration information, room/device relationships and other information necessary to configure and operate the system.

Precise geographic coordinates are not required for every Dropair feature. Where a feature requires location information, we will request or derive only information reasonably necessary for that feature, subject to applicable law and platform permissions.

### 4.7 Environmental and Indoor Climate Data

Depending on installed sensors, Dropair Services may process temperature, relative humidity, CO2, VOC, PM2.5, PM10, atmospheric pressure, illuminance, air-quality indicators, environmental trends and other supported environmental measurements.

### 4.8 Outdoor Weather and Environmental Information

Dropair Climate may combine indoor information with outdoor temperature, humidity, feels-like temperature, wind, weather conditions, forecasts, pressure, UV information, precipitation, sunrise/sunset, solar information and other environmental information from third-party sources.

### 4.9 Presence and Activity Information

Where supported and enabled, Dropair may process sensor observations used to estimate whether a room or zone is occupied and the general activity state within the environment. Inputs may include PIR motion, mmWave presence/movement, door/window contacts, BLE or device-presence indicators where supported, environmental changes, illuminance changes, acoustic environmental metrics, time context and historical patterns.

Dropair Climate may derive occupancy probability, presence confidence, general activity intensity, resting/normal/active states, pre-sleep or sleeping estimates where supported, and changes in general activity state. These are probabilistic estimates and may be incorrect. They are designed primarily to improve environmental control, comfort, energy efficiency, automation and system operation.

### 4.10 Acoustic Environmental Metrics

Certain present or future Dropair products may support acoustic environmental sensing. Dropair Climate is designed to use environmental metrics such as approximate sound-pressure/noise level, average and peak noise level, noise variation, acoustic trend and generalized activity indicators derived from acoustic intensity.

**Dropair Climate does not require understanding the semantic content of conversations.** Where acoustic sensing is implemented for Climate purposes, our preferred architecture is to process acoustic signals locally and transmit non-recoverable environmental metrics rather than recoverable audio.

Unless a separate feature clearly states otherwise and provides legally required notice or choice, Dropair Climate is not designed to record conversations for Climate analysis, identify speakers, transcribe speech, perform semantic analysis of private conversations, or upload recoverable continuous room audio to Dropair Cloud for Climate decision-making.

### 4.11 HVAC and Equipment Operating Data

We may process HVAC mode, target temperature, fan speed, equipment state, valve/relay state, runtime, heating/cooling demand, measured response, energy-related information where supported, equipment commands, acknowledgements and historical operating trends.

### 4.12 User Commands, Preferences and Automation Information

We may process manual temperature changes, mode/fan adjustments, schedules, Eco settings, automation settings, manual overrides, room preferences, comfort feedback, Climate selections and interactions with recommendations or automated actions.

### 4.13 Climate Models, Predictions and Derived Information

Dropair Climate may derive environmental trends, expected temperature changes, estimated time to comfort target, building thermal-response characteristics, thermal-retention indicators, solar-gain effects, equipment capability, occupancy confidence, activity estimates, comfort estimates, likely climate preferences, energy-saving opportunities and confidence values. These outputs are model-based estimates and are not guaranteed to be accurate.

### 4.14 Logs and Technical Information

We may collect IP address, device type, operating system, application/browser version, timestamps, time-zone information, language, session identifiers, authentication events, API requests, errors, crash information, network diagnostics, server receipt times, device event times and security logs.

### 4.15 Support and Communications

If you contact Dropair, we may collect contact information, correspondence, support messages, screenshots/files you provide, product and diagnostic information, issue descriptions, repair/warranty information and resolution records.

### 4.16 Cookies and Similar Technologies

Web Services may use cookies, local/session storage or similar technologies for authentication, security, session maintenance, preferences, reliability measurement and analytics where permitted. Where applicable law requires consent for non-essential technologies, appropriate controls will be provided.

## 5. Sources of Information

We may obtain information directly from you; from your Dropair devices; from authorized organization/Site administrators; from installers, dealers or distributors involved in your installation or transaction; from identity providers; payment providers; logistics providers; third-party smart-home integrations you choose; weather/environmental-data providers; automatically through your use of Services; and from affiliated companies involved in providing the relevant product or Service.

## 6. How We Use Information

We may use information to:

- create, authenticate and maintain Dropair IDs;
- manage roles and permissions;
- commission, configure, operate and remotely manage devices;
- operate Dropair Cloud and connected services;
- provide firmware/software updates and licensing;
- provide Dropair Climate and automation functions;
- execute authorized user commands;
- process quotations, orders, payments, shipping, warranties, returns and repairs;
- provide technical support and diagnostics;
- protect accounts, devices, networks and Services against fraud, abuse and unauthorized access;
- comply with law and enforce agreements;
- communicate operational, transaction, security and Service information; and
- maintain, analyze and improve our products, Services, algorithms, compatibility, reliability and user experience.

### 6.1 Climate Intelligence and Automation

Where enabled, information may be used to understand indoor conditions, analyze trends, estimate presence and general activity, estimate thermal comfort, learn climate preferences, understand building thermal behavior, estimate HVAC response, predict future conditions, recommend or execute climate-control actions, optimize comfort and indoor air quality, reduce unnecessary energy use, and evaluate whether previous Climate actions achieved expected results.

## 7. Legal Bases for Processing

Privacy laws use different terminology and legal frameworks. Where a legal basis is required, Dropair may rely on one or more of the following depending on the processing and jurisdiction:

### 7.1 Performance of a Contract

Processing may be necessary to provide a Dropair ID, requested Services, device management, orders, support or another agreement with you.

### 7.2 Legitimate Interests

Where permitted, we may process information for legitimate interests such as securing accounts and systems, preventing abuse, maintaining and improving Services, diagnosing problems, understanding product performance, protecting Dropair/customers/users and developing useful and reliable climate-control functionality. Where required, we balance these interests against affected individuals' rights and interests.

### 7.3 Legal Obligations

We may process information where necessary to comply with tax, accounting, regulatory, safety, consumer-protection, law-enforcement or other legal obligations.

### 7.4 Consent

We rely on consent where applicable law requires it, for example for certain optional communications, non-essential tracking technologies or specific data uses. Where processing is based on consent, you may withdraw consent subject to applicable law. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

### 7.5 Other Lawful Bases

Where local law recognizes other lawful grounds, such as protecting vital interests or performing tasks recognized by law, we may rely on them where appropriate.

## 8. Automated Processing and Dropair Climate

Dropair Climate may use automated processing to make predictions, recommendations or control decisions relating to building climate and connected equipment.

Examples include adjusting or recommending temperature, humidity strategy, airflow, HVAC operating mode, timing, Eco behavior or other environmental-control actions.

Climate outputs are based on available data and may be uncertain or incorrect. Model outputs may include confidence estimates and may evolve as algorithms improve.

Dropair Climate is intended for environmental comfort, building operation, indoor-air-quality support, energy optimization and related functions. Unless a separate Service expressly states otherwise, Dropair Climate is not designed to make decisions that determine eligibility for employment, credit, insurance, housing, education, government benefits or other decisions producing legal or similarly significant effects on an individual.

Where applicable law provides rights relating to qualifying automated decision-making, Dropair will honor those rights as required.

## 9. Manual Controls and User Feedback

Where supported, users may override automated Climate actions or change settings manually. Dropair may use these interactions as feedback for system operation and personalization.

A manual change is not necessarily treated as definitive evidence of a permanent preference. The system may consider context, timing, repeated behavior and other signals before adjusting learned preferences.

## 10. How We Share Information

We may share information only as reasonably necessary for the purposes described in this Policy or as otherwise permitted by law.

### 10.1 Dropair Affiliated Companies

Information may be shared among Dropair affiliated companies where necessary to provide products, software, hardware, logistics, support, technical services, customer service or other legitimate business functions.

### 10.2 Service Providers and Processors

We may use third parties for services such as cloud hosting, infrastructure, email delivery, identity/authentication support, analytics, security, customer support, payment processing, logistics, communications and other operational functions.

These providers receive information appropriate to their function and are subject to contractual or legal obligations where required.

### 10.3 Payment Providers and Financial Institutions

Information necessary to complete payments, prevent fraud, issue refunds or reconcile transactions may be shared with payment providers, banks and related financial institutions.

### 10.4 Shipping, Customs and Logistics Providers

Where physical products are shipped, relevant contact, destination, product and transaction information may be shared with carriers, customs brokers, warehouses and other logistics providers.

### 10.5 Dealers, Distributors and Installers

Where you purchase through, authorize or work with a dealer, distributor, installer or contractor, relevant Site, device, product, support or transaction information may be available to that party according to its authorized role.

You should remove or modify third-party access when it is no longer required, where the Service provides such controls.

### 10.6 Third-Party Integrations

If you choose to connect Dropair with a third-party ecosystem or service, information necessary to provide the integration may be exchanged with that third party at your direction or as described during setup.

The third party's own privacy policy applies to its independent processing.

### 10.7 Legal, Safety and Security Disclosures

We may disclose information when we reasonably believe disclosure is required or permitted to comply with law or legal process; respond to lawful governmental requests; protect users, Dropair or others; investigate fraud, abuse or security incidents; or establish, exercise or defend legal claims.

### 10.8 Business Transfers

If Dropair or part of its business is involved in a merger, acquisition, financing, reorganization, sale of assets or similar transaction, relevant information may be transferred subject to applicable law and appropriate protections.

## 11. Sale and Sharing of Personal Information

Dropair does not treat ordinary provision of the Services as permission to sell personal information for money.

Some privacy laws, including certain U.S. state laws, define "sale" or "sharing" more broadly than ordinary language and may include certain disclosures involving advertising or cross-context behavioral advertising.

If Dropair engages in activities that constitute a regulated "sale" or "sharing" under applicable law, we will provide the notices and opt-out mechanisms required by that law.

Dropair does not knowingly sell or share personal information of children in circumstances prohibited by applicable law.

## 12. Advertising and Marketing

Operational communications necessary for your account, transactions, devices, security and Services are not marketing messages.

Where Dropair sends promotional communications, we will provide choices required by applicable law, such as unsubscribe mechanisms or prior consent where required.

We do not require acceptance of optional marketing communications as a condition for creating a Dropair ID unless the communication is necessary to provide the requested Service.

## 13. International Data Transfers

Dropair serves customers globally. Information may therefore be processed in countries or regions other than the place where you live or where a Dropair device is installed.

Depending on the Service, information may be transferred to or accessed by DROP AIR K.K., affiliated companies, cloud/infrastructure providers and other service providers located in Japan or other countries.

Where applicable law requires safeguards for international transfers, Dropair will use appropriate mechanisms. Depending on jurisdiction and circumstances, these may include adequacy decisions, contractual protections such as standard contractual clauses, the UK International Data Transfer Agreement/Addendum, data-processing agreements, consent where legally appropriate, or other recognized mechanisms.

For transfers subject to Japan's Act on the Protection of Personal Information (APPI), Dropair will take measures required for cross-border handling and provision of personal data.

For transfers from the European Economic Area, United Kingdom or Switzerland, we will use a lawful transfer mechanism where required.

## 14. Data Localization

Some jurisdictions may impose data-localization, sector-specific or governmental-access requirements. Where legally required and applicable to a Dropair Service, we may use region-specific storage or processing arrangements or provide supplemental notices.

A user's Site time zone or physical location does not necessarily determine the physical location of all cloud storage unless a Service expressly states otherwise.

## 15. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy, including to provide Services, maintain account/device history, support Climate learning and diagnostics, comply with legal obligations, resolve disputes, enforce agreements and protect security.

Retention periods vary according to data type, purpose, legal requirements, contractual obligations, account status and technical needs.

Examples of factors include:

- whether the Dropair ID remains active;
- whether a device or Site remains associated with an account;
- warranty, transaction and accounting requirements;
- whether historical data is needed for Climate models or user-requested history;
- security and fraud-prevention requirements;
- support and diagnostic needs; and
- applicable statutes of limitation.

Where information is no longer reasonably necessary, we may delete it, anonymize/de-identify it, aggregate it, or isolate it from active use, subject to legal and technical requirements.

Backup copies may persist for a limited period after deletion from active systems.

## 16. Climate Historical Data and Model Improvement

Historical environmental and equipment data can be important for Climate functions such as learning building response, equipment performance, occupancy patterns and user preferences.

Where applicable and permitted, Dropair may retain historical data for these purposes. Model versions may be evaluated against historical data to improve accuracy and reliability.

Where practical, product research and aggregate performance analysis may use de-identified or aggregated information.

## 17. Time, Time Zones and Historical Logs

Dropair systems may distinguish:

1. the absolute UTC time of an event;
2. the local time of the Site where the event occurred; and
3. the current local time of the user viewing the event.

Historical Site events may be displayed using the Site time zone that applied when the event occurred, even if the user later views the information from another country or changes the phone's time zone.

We may retain event-time metadata, including Site time-zone context and offsets, to preserve accurate history, diagnostics and Climate replay.

## 18. Security

Dropair uses reasonable administrative, technical and organizational safeguards appropriate to the nature of the information and Services.

Measures may include, as appropriate:

- authentication and access controls;
- encryption in transit;
- encryption at rest where appropriate;
- secure password hashing;
- role-based permissions;
- security logging;
- monitoring;
- software/firmware security controls;
- vulnerability management;
- backups and resilience measures;
- restricted administrative access; and
- incident-response procedures.

No information system is completely secure. We cannot guarantee that unauthorized access, loss, misuse or security incidents will never occur.

## 19. Account and Organization Security

Users are responsible for protecting their authentication credentials and for appropriately managing access they grant to organizations, Sites and devices.

Organization administrators may have access to information associated with organization-managed Sites, devices or users according to their permissions.

If you leave an organization, access to organization resources may be removed without necessarily deleting your personal Dropair ID.

## 20. Data Breach and Security Incident Response

If a security incident involving personal information occurs, Dropair will investigate and take reasonable remediation measures. Where applicable law requires notification to individuals, regulators or other authorities, Dropair will provide notification in accordance with those requirements.

## 21. Your Privacy Rights

Depending on where you live and applicable law, you may have rights including:

- to know or be informed about processing;
- to request access to personal information;
- to request correction of inaccurate information;
- to request deletion or erasure;
- to request restriction of certain processing;
- to object to certain processing;
- to receive certain information in a portable format;
- to withdraw consent where processing is based on consent;
- to opt out of certain sales, sharing, targeted advertising or profiling where applicable;
- to limit certain uses of sensitive personal information where applicable;
- to receive information about qualifying automated decision-making;
- to appeal certain privacy-request decisions where local law provides that right; and
- to lodge a complaint with an appropriate privacy or data-protection authority.

These rights are not absolute and may be subject to legal exceptions. For example, we may need to retain certain transaction, security or legal records even after an account-deletion request.

## 22. How to Exercise Privacy Rights

Privacy requests may be submitted through privacy/account controls made available by Dropair or through the contact method published for privacy requests.

We may need to verify your identity before fulfilling a request. Verification measures will be proportionate to the nature of the request and information involved.

Authorized agents may submit requests where applicable law permits, subject to appropriate verification and proof of authority.

We will not discriminate against you for exercising privacy rights protected by applicable law.

## 23. Japan Privacy Rights (APPI)

Where Japan's Act on the Protection of Personal Information (APPI) applies, individuals may have rights relating to retained personal data, including requests for disclosure, correction, addition, deletion, suspension of use, erasure, or suspension of third-party provision, subject to the conditions and exceptions provided by law.

Dropair will handle cross-border provision and other processing of personal data in accordance with applicable APPI requirements.

## 24. European Economic Area (EEA)

Where the EU General Data Protection Regulation (GDPR) applies, you may have rights including access, rectification, erasure, restriction, objection, data portability, withdrawal of consent and rights relating to certain automated decision-making.

Where processing relies on legitimate interests, you may object where the GDPR provides that right. Where processing is for direct marketing, you may object to such processing as provided by law.

You also have the right to lodge a complaint with the competent supervisory authority, including an authority in the EEA country where you live, work or believe an infringement occurred.

Where Dropair is required to appoint an EU representative or otherwise provide additional regional contact information, that information will be made available in a supplemental notice or updated version of this Policy.

## 25. United Kingdom

Where the UK GDPR and Data Protection Act 2018 apply, you may have rights broadly including access, rectification, erasure, restriction, objection, portability, withdrawal of consent and protections relating to qualifying automated decisions.

You may also have the right to complain to the UK Information Commissioner's Office (ICO).

Where Dropair is required to appoint a UK representative, relevant contact information will be provided as required.

## 26. Switzerland

Where Swiss data-protection law applies, Dropair will process personal data in accordance with applicable Swiss requirements, including applicable transparency, security, access and cross-border-transfer requirements.

## 27. California Privacy Notice

This section supplements the Policy for California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), applies to Dropair's processing.

### 27.1 Categories of Personal Information

Depending on your use of the Services, Dropair may process categories such as identifiers; customer records/contact information; commercial information; internet or electronic network activity; geolocation information where a feature uses it; sensory/environmental information; professional or employment-related information for business accounts; inferences derived from device, environmental or usage data; and other information described in this Policy.

### 27.2 Purposes

We use these categories for the business and commercial purposes described in Sections 6 and 8, including providing Services, device operation, Climate functionality, transactions, support, security, diagnostics and product improvement.

### 27.3 Sources and Disclosures

Sources are described in Section 5. Categories of recipients are described in Section 10.

### 27.4 California Rights

Subject to applicable conditions and exceptions, California residents may have rights to:

- know/access personal information;
- request deletion;
- request correction;
- opt out of sale or sharing of personal information;
- limit certain uses/disclosures of sensitive personal information where the statutory right applies; and
- receive equal service and price without unlawful discrimination for exercising CCPA rights.

If Dropair engages in regulated sale or sharing, we will provide the required opt-out mechanism, which may include a "Do Not Sell or Share My Personal Information" link or an equivalent legally recognized method.

Where required, we will process recognized opt-out preference signals in accordance with applicable law.

### 27.5 Sensitive Personal Information

Some information processed by certain Dropair features could fall within statutory definitions of sensitive personal information depending on context and applicable law. Dropair will provide legally required limitations or notices where applicable.

### 27.6 Retention

We do not intend to retain categories of personal information longer than reasonably necessary for the disclosed purposes, taking into account the factors described in Section 15.

## 28. Other U.S. States

Residents of certain U.S. states may have additional rights under comprehensive state privacy laws, potentially including access, correction, deletion, portability, opt-out rights relating to targeted advertising, sale or certain profiling, and rights to appeal privacy-request decisions.

Where such laws apply to Dropair, we will honor applicable rights and provide required mechanisms.

## 29. Canada

Where Canadian privacy law applies, Dropair will process personal information in accordance with applicable federal and provincial requirements, including requirements concerning appropriate purposes, safeguards, access/correction and consent where required.

You may contact Dropair regarding access, correction or privacy concerns using the contact information in this Policy.

## 30. Australia and New Zealand

Where Australian or New Zealand privacy laws apply, Dropair will handle personal information in accordance with applicable privacy principles and legal requirements, including requirements relating to notice, security, access/correction and overseas disclosures where applicable.

## 31. Other Countries and Regions

Dropair operates globally. Other countries and regions may provide additional privacy rights or impose additional requirements concerning consent, data localization, cross-border transfer, direct marketing, children's data or other processing.

Where those requirements apply to a Dropair Service, we will provide additional notices, controls or contractual measures as reasonably required.

## 32. Children's Privacy

Dropair's general account and building-control Services are not directed to young children as independent account holders unless a specific Service is expressly designed for them and appropriate safeguards are provided.

We do not knowingly seek to collect personal information directly from children below the age at which they may independently consent to relevant processing under applicable law without appropriate authorization.

Connected-home sensors may incidentally reflect environmental conditions or general presence/activity within a household that includes children. Such information is processed for building/environmental operation rather than to create advertising profiles of children.

If you believe a child has created an account or provided personal information in a manner inconsistent with applicable law, please contact us.

## 33. Biometric Information

Dropair Climate's ordinary presence and activity functions are not intended to perform facial recognition, voiceprint identification, fingerprint identification or other biometric identity recognition unless a separate feature expressly states otherwise.

General mmWave presence, PIR motion, environmental activity estimates and non-recoverable acoustic intensity metrics are used to understand environmental state and are not intended to establish a person's biometric identity.

If Dropair introduces a feature that processes legally regulated biometric identifiers, we will provide additional notice and obtain consent or other authorization where required.

## 34. Health Information

Dropair Climate environmental and comfort information is not intended to provide medical diagnosis or treatment.

Indoor temperature, humidity, air quality, activity estimates and comfort information should not be interpreted as medical advice.

Unless a separate Service expressly states otherwise, Dropair is not providing a healthcare service and does not intentionally use Climate information to infer medical diagnoses.

## 35. Third-Party Smart-Home Platforms

Dropair products may interact with third-party platforms such as Matter ecosystems or other compatible smart-home services.

When you connect a Dropair product to a third-party platform, that platform may independently collect or process device, home, account or usage information according to its own terms and privacy policy.

Dropair does not control independent processing performed by third-party platforms.

## 36. Links to Third-Party Services

Dropair websites or applications may contain links to third-party websites or services. Dropair is not responsible for the privacy practices of independent third parties. You should review their privacy notices before providing information.

## 37. De-Identified and Aggregated Information

Where permitted by law, Dropair may create aggregated, statistical or de-identified information that is not reasonably intended to identify an individual.

Such information may be used for purposes including product development, system-performance analysis, energy/climate research, reliability analysis, compatibility analysis and business planning.

Where applicable law regulates de-identified information, Dropair will handle it in accordance with applicable requirements and will not attempt to re-identify it except where permitted for security, validation or legal compliance.

## 38. Research, Testing and Model Evaluation

Dropair may evaluate new Climate algorithms, model versions and control strategies using historical or simulated data.

Where customer-derived information is used, access should be limited to what is reasonably necessary for evaluation, improvement, security and reliability. Where practical, aggregated, pseudonymized or de-identified information should be used for broader research and analytics.

Experimental or preview features may be subject to additional notices.

## 39. Service Providers and AI/Model Providers

If Dropair uses third-party computing, analytics, machine-learning or AI service providers to support a feature, information shared with such providers will be limited according to the relevant purpose and subject to appropriate contractual, technical and legal safeguards where required.

Dropair will not treat the use of an external AI service as permission to disclose unrestricted customer data. Feature-specific disclosures will be provided where the nature of processing materially differs from this Policy.

## 40. Privacy by Design for Climate

Dropair intends to apply privacy-by-design principles to Climate architecture, including where appropriate:

- collecting data relevant to climate/building functions rather than unnecessary content;
- processing certain high-frequency signals locally where practical;
- transmitting derived metrics instead of raw content where appropriate;
- separating authentication identity from device/environment telemetry where practical;
- using access controls and role boundaries;
- tracking model confidence rather than presenting inference as certainty;
- retaining provenance for important system events; and
- providing user controls appropriate to the feature.

## 41. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in Services, technology, law or business practices.

The current version will identify its last-updated date.

Where a change materially affects privacy rights or processing and applicable law requires notice or consent, we will provide appropriate notice and obtain consent where required.

A change to the Privacy Policy does not automatically mean that every user must provide new contractual consent. Dropair will distinguish between privacy notice updates and processing that legally requires renewed consent.

## 42. Language and Translations

Dropair serves users globally and may provide translations of this Privacy Policy.

Where local law requires a particular language version to control, that requirement will apply. Otherwise, Dropair may identify an authoritative version in the applicable Service or regional notice.

Translations should be maintained to accurately reflect the substance of the current global policy.

## 43. Contacting Dropair

Privacy questions, requests and complaints may be directed to DROP AIR K.K. using the privacy contact methods published in the Dropair App, website or relevant Service.

**Legal Entity:** DROP AIR K.K.\
**Country:** Japan

Dropair should publish and maintain a dedicated privacy contact channel (for example, a privacy email address or web request form) before production deployment of this Policy.

For technical support, the currently published support channel may include:

**WhatsApp: +81 70 4304 1687**

Technical-support channels should not be treated as the sole privacy-rights request channel once a dedicated privacy channel is available.

## 44. Complaints and Supervisory Authorities

If you have a privacy concern, we encourage you to contact Dropair so that we can review it.

Depending on your jurisdiction, you may also have the right to lodge a complaint with a privacy, data-protection or consumer-protection authority.

## 45. Supplemental Notices

Certain Services, countries, devices or features may require supplemental privacy notices. A supplemental notice forms part of this Privacy Policy for the relevant processing.

If a supplemental notice conflicts with this global Policy regarding a specific processing activity, the more specific notice will govern that activity to the extent permitted by law.

---

# Appendix A — Dropair Climate Data Overview

The following table provides a high-level description of major Climate data categories.

| Model / Data Area | Example Inputs | Example Derived Outputs | Primary Purpose |
|---|---|---|---|
| Environment | Temperature, humidity, CO2, VOC, PM2.5, PM10, pressure, illuminance | Trends, environmental state | Indoor climate and air-quality understanding |
| Outdoor | Weather, forecast, temperature, humidity, wind, UV | Outdoor influence estimates | Predict indoor impact and future conditions |
| Building | Indoor/outdoor changes, HVAC response, openings | Thermal retention, inertia, solar gain, leakage indicators | Understand building behavior |
| Equipment | HVAC mode, setpoint, fan, runtime, response | Heating/cooling capability, estimated time to target | Predict equipment performance |
| Presence | PIR, mmWave, contacts, compatible presence signals | Occupancy probability/confidence | Determine whether a zone is likely occupied |
| Activity | Presence, motion intensity, light, environmental changes, acoustic metrics, time | Resting/normal/active/sleep-related estimates | Adapt comfort strategy to general activity |
| Preference | Manual changes, comfort feedback, historical behavior | Preferred climate ranges and tendencies | Personalize Climate behavior |
| Acoustic Environment | Noise level, average, peak, variance, trend | Acoustic activity indicator | Auxiliary activity/environment context without requiring conversation semantics |
| Temporal Context | UTC, Site time zone, day, season, sunrise/sunset | DayPart, seasonal context | Interpret environmental and human context over time |
| Climate Decision | Model states and predictions | Recommendations, control intent, confidence, reason codes | Optimize comfort, IAQ and energy use |

---

# Appendix B — Dropair ID Privacy and Consent Records

Dropair may maintain records showing which legal documents were presented during account creation or required updates.

Example conceptual record:

```json
{
  "userId": "...",
  "termsDocumentId": "dropair-terms",
  "termsVersion": "2026-04-01",
  "privacyDocumentId": "dropair-privacy-policy",
  "privacyVersion": "2026-04-01",
  "acceptedAtUtc": "...",
  "acceptanceMethod": "email_registration"
}
```

Dropair should distinguish among:

- contractual acceptance of Terms;
- acknowledgement that a Privacy Policy was provided/read;
- optional consent; and
- consent legally required for a specific processing activity.

Optional consent should not be bundled with mandatory account creation unless legally and functionally necessary.