Privacy Notice

Last Updated: Jun 6, 2026

Overview

This privacy notice ("Privacy Notice") describes how Carbon Catalyst Inc. (collectively "Catalyst" "we," "our," "us") (a) collects, uses, retains, shares, or otherwise processes your Personal Information (as defined below) and (b) describes your rights regarding your Personal Information and how to exercise those rights. Please read this Privacy Notice carefully to understand our policies and practices regarding your Personal Information and how we will treat it.

Modification of This Privacy Notice

This Privacy Notice may be modified from time to time. The date this Privacy Notice was "last updated" is at the top of this page. If we make a material change to this Privacy Notice, we will publish the updated Privacy notice to https://xds.co/pages/privacy-policy. We advise you to frequently check this Privacy Notice for any changes. We may also provide notice of such changes to you in other ways, at our discretion, such as by displaying a notification banner on the homepage of our website or by emailing you at the email we have on file for you.

[Your use of the Services (as defined below), and continued use of the Services following any changes to this Privacy Notice, signifies you have read and understand the terms of this Privacy Notice. If you do not agree with the terms of this Privacy Notice, your choice is to not use the Services.]

When This Privacy Notice Applies

This Privacy Notice applies to Personal Information we collect from or about you when you visit, use, or interact with the services we provide to you (collectively, the "Services"), which include but are not limited to:

• Our website(s): https://xds.co;
• Our mobile application(s): X-LAB Bikes;
• Our online communications via email, social media, or advertising;
• Our brick & mortar stores;
• Our sweepstakes, contests, and promotions; or
• Telephone or in-person communications.

This Privacy Notice also applies wherever it is linked or referenced in connection with our products and Services. Please also note that if you are a California resident, a Washington resident, a Nevada resident, or a resident of the European Economic Area, you may have additional options and/or rights concerning your Personal Information. Please see the California Notice, the Consumer Health Data Privacy Notice, and the GDPR Notice to learn more.

As used in this Privacy Notice, "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual.

When This Privacy Notice Does Not Apply

This Privacy Notice does not apply to your Personal Information if:

• You are our employee or independent contractor carrying out your obligations as an employee or independent contractor;
• You apply for a job with us;
• We've provided you with an alternate privacy notice at the time of collection; or
• You interact with third-party digital assets that are linked to or accessible from the Services.

Type of Personal Information Collected; Source of Personal Information

The types of Personal Information we collect about you depend on your interactions with us and on our Services. In this section, we describe the categories of Personal Information we collect, organized by the sources of this data.

By interacting with the Services, you grant us the right to use your Personal Information to enable us to provide the Services to you, to improve the Services, and other uses as stated in this Privacy Notice, in our Terms of Use, and in any ancillary agreements you may have entered into with us related to our Services. If you do not provide your Personal Information when requested, you may not be able to use our Services or certain features of our Services in whole or in part (a) if that Personal Information is necessary to provide you with our Services or such features, or (b) if we are legally required to collect the requested Personal Information.

Personal Information You Directly Provide to Us

In addition to any other categories of Personal Information we state we are collecting at the time of collection, we may also collect the following Personal Information that you provide directly to us:

• Personal Data. Data by which you may be personally identified such as name, address, phone number, email address, or any other data linked to your identity;
• Demographic Data. Data that is about you but that as an individual piece of data does not specifically identify you, such as birthdate, zip code, gender, and age;
• Communications Data. Data from your interactions with us, including when you request information about our Services, provide feedback, complete forms, or contact our customer service team. This may include your contact details, the date and time of communications, the content of your messages, and recordings of calls and chat sessions;
• Login Data. Data related to your account such as username, password, and security questions;
• Transaction Data. Data related to our Services, such as the type of Services or products requested or provided, order details, delivery information, or the amount charged. To complete a transaction, you may be required to provide payment and financial data such as the type of card, card number, expiration date, security code, and billing address. When you make purchases through our online store, payment processing may be handled by Shopify or other payment processors integrated with our Shopify platform. These processors collect and handle payment information according to their own privacy policies and security standards. We do not have direct access to, process, transmit, handle, or store any of your credit or debit card details;
• More Sensitive Data. Data that is about you and that is sensitive, including health data, gender, and precise geolocation information;

Data Automatically Collected About You

As you navigate through and interact with our Services, we, our service providers, or other third parties may use cookies, log files, pixels tags, software development kits ("SDKs"), and other client-side or server-side automatic data tracking technologies ("Automatic Tracking Technologies") to collect certain data about your equipment, browsing actions, and patterns, including the following types of data:

• Device Data. Data when you interact with the Services such as technical data about your device including your IP address; unique identifiers and device type; domain, browser type, version, and language; operating system and system settings; and similar device data.
• Usage Data. Data about your visits to and usage of our Services including, for example, usage details (i.e., date/time/duration on a given webpage), traffic data, logs, general location and time zone based on your IP address, other communication data and the resources that you access and use on the Services, and navigation paths within the webpages. This data may include links clicked, webpage views, searches, features used, items viewed, or time spent on the Services.

The Automatic Tracking Technologies we may use include the following:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate settings on your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Services.
• Flash Cookies. Certain features of our Services may use locally stored objects (or flash cookies) to collect and store data about your preferences and navigation to, from, and on our Services. Flash cookies are not managed by the same browser settings as are used for browser cookies.
• Log Files. Log files are software-generated files containing data about the operations, activities, and usage patterns of an application, server, or IT system, such as what was done and at what time.
• SDKs. A SDK (as defined in Section 2.2 above) represents a consolidated package of pre-existing code, enhancement tools, and guidance documents that can be installed and used to develop applications for a particular digital asset. SDKs allow our partners to directly extract data from our Services. The data collected has numerous applications including offering us insightful analytics about usage of our Services, enabling social media incorporation, introducing new attributes or capabilities to our Services, or assisting in tracking and enhancing the efficacy of our online advertisements.
• Web Beacons. Pages of our websites may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages or for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).

Through our Shopify-hosted platform, Shopify may automatically collect device information (IP address, device identifiers, browser information), usage data about your interactions with our Services and other Shopify merchants, and activity data across their platform. Shopify may link this information across different devices and accounts you use when interacting with Shopify merchants and services.

Personal Information We Collect from Other Sources

We may receive the data described above from other sources such as service providers and other third parties who help us provide the Services or market our Services to you. These other sources we may receive data from include the following:

• Service Providers. We may use service providers to provide the Services to you or for any other purpose described in the How We Use Your Personal Information section below. These service providers have contractual obligations regarding how they are allowed to use the data we provide to them, which is limited to the purpose in which we provide it and for no other purpose.
• E-commerce Platform Provider (Shopify). Our online store is hosted by Shopify Inc., which provides us with an e-commerce platform to provide our Services to you. When you interact with our online store, Shopify may collect and process Personal Information both on our behalf and for their own business purposes.
• Publicly Available Sources. Data that is publicly available.
• Other Third Parties. We may use other third parties to assist us with providing the Services to you or for any other purpose described in the How We Use Your Personal Information section below. These third parties may provide us data about you such as data about your interaction with our Services, marketing campaigns, or events in which we and you participate. These third party's privacy notices govern the collection and disclosure of your data by such third party.

How We Use Your Personal Information

We, along with our service providers or other third parties, may use your Personal Information for the purposes described below. As part of these purposes, your Personal Information may be processed using artificial intelligence technologies. We may use your Personal Information for the following purposes:

• Provide and Improve our Services. To provide, deliver, administer, support, maintain, and improve the Services and related products you request, including personalizing the content and features that match your activities, preferences, and settings, and to monitor and analyze trends, usage, and activities in connection with the Services.
• Communicate with You. To communicate with you, including when you request additional information from us, or when we contact you about your account, such as reminders about your subscription renewal or a material change to our policies that affect you, or in connection with the Services and related products you have purchased from us. Notwithstanding any other statement in this Privacy Notice, if we collect your phone number with consent to communicate with you via text messages, we will only do so for the purpose provided at the time you consented.
• Advertise and Market to You. To send advertising or marketing communications about products, or services offered by us and others, and provide news and information that we believe may be of interest to you, and to analyze and enhance our marketing communications and strategies. For information about managing your marketing preferences, see the Your Choices About Your Personal Information section below.
• Provide Safety and Security. To detect and protect against malicious, deceptive, or illegal activity, including fraudulent transactions, errors, negligence, violations of any applicable terms, security incidents, and harm to the rights, property, or safety of us and our users, customers, employees, or others.
• Troubleshoot. To identify and debug errors that impair the existing intended functionality of our Services.
• Facilitate Corporate Transactions. In anticipation of or in connection with a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which the data held by us is among the assets transferred.
• Obtain Your Consent. In accordance with (i) the way we describe to you when you provide the data to us, (ii) your instruction or intentional direction, or (iii) any other way when you consent.
• Comply with Legal Obligations. To comply with our legal or regulatory obligations, including our tax obligations and those related to the prevention of fraud and money laundering, and those required for you to benefit from rights recognized by law, or any regulatory requirements or provisions.
• Shopify Enhanced Services. When Shopify Network Intelligence is enabled (for features like Shopify Audiences, Shop channel, Shopify Email), Shopify aggregates your anonymized data (e.g., hashed email, purchase history) with other merchants' data to generate marketing audiences and personalization insights. Shopify does not share identifiable data with other merchants.
• Inferences. In addition to the types of data and sources of data we describe above, we may also draw inferences or derive data about you based on other types of data we collect about you to create a profile reflecting your interest, preferences, and characteristics. We may use this data to enhance your experience on the Services, to track analytics about the usage of our Services, or to serve advertisements, including targeted advertisements to you.

We may also aggregate or de-identify Personal Information and use it without restriction, including but not limited to enhance and personalize your experience with us, for promotional purposes, to test our IT systems, for research, data analysis, to improve our Services, to develop new products and features, and for other purposes consistent with applicable law. We will maintain aggregated or de-identified data in a form that cannot reasonably be used to infer data about, or otherwise be linked to, a particular individual. We will not attempt to reidentify such data.

Whom We Share Your Personal Information With & the Purpose of Disclosure

We may disclose Personal Information that we collect from you or that you provide as described in this Privacy Notice to the following categories and for the purposes set forth below:

• Service Providers. We disclose Personal Information to unaffiliated companies or individuals we hire or work with that perform services on our behalf, including customer support, web hosting, software developers, information technology services, database management, direct mail and email distribution. These service providers may have access to Personal Information we collect from you to perform the specific services we request from them.
• E-commerce Platform Services. We share Personal Information with Shopify Inc., our e-commerce platform provider, to enable online store functionality, payment processing, order fulfillment, and related e-commerce services. Shopify also processes your Personal Information for their own business purposes as described in their privacy policy (available at https://www.shopify.com/legal/privacy).
• Analytics and Advertising. We engage third parties to provide analytics services, serve advertisements, and perform related services across the web and in mobile applications. These entities may use Automatic Tracking Technologies to collect data about your use of the Services, and on other third-party digital assets, including your IP address and other identifiers, web browser network information, pages viewed, time spent on pages or in mobile applications, links clicked, and conversion data. These third parties may use this data to deliver advertisements that are more relevant to you across the web and in mobile applications, to analyze and track data, determine the popularity of certain content, and better understand your online activity.
• Corporate Transaction. Your Personal Information may be disclosed or transferred in anticipation of, or in connection with, a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which data held by us is among the assets transferred.
• Law Enforcement Authorities and Individuals Involved in Legal Proceedings. We disclose Personal Information when we believe doing so is reasonably necessary to comply with applicable law or a legal process (including an enforceable request from authorities), to respond to claims (including inquiries by you in connection with your purchases from us), enforce or apply our other policies, or to protect the rights, property, or personal safety of us, our users, employees, or others.
• Professional Advisors. We may disclose your Personal Information to professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us.
• Your Consent or at Your Direction. We disclose Personal Information to third parties when we have your consent or direction to do so. We may also disclose your Personal Information to third parties, such as when you expressly direct us to do so or when you use our products or Services to intentionally interact with third parties. In these cases, we disclose your Personal Information to carry out your request.

How We Protect Your Personal Information

We have implemented measures designed to secure your Personal Information from accidental loss and unauthorized access, use, alteration, and disclosure. The safety and security of your data also depend on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. Do not share your password with anyone.

Unfortunately, the transmission of data via the Internet is not completely secure. Although we use reasonable efforts to protect your Personal Information, we cannot guarantee the security of your data transmitted to our Services. Any transmission of data is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained in the Services.

Retention of your Personal Information

We may retain your Personal Information for as long as we need it to provide you with the Services. If you ask us to delete your Personal Information or if you have an account with us, and you delete your account, there may be some latency in deleting this data from our servers and back-up storage, and some data may not be completely removed from our logs and other records. In addition, we may retain this data if necessary to comply with our legal obligations, resolve disputes, or enforce our agreements.

When we process Personal Information, we determine the retention period taking into account various criteria, such as the type of Services provided to you, the nature and length of our relationship with you, the impact on our Services we provide to you if we delete some data from or about you, and mandatory retention periods provided by law.

Your Choices About Your Personal Information

We strive to provide you with choices regarding the Personal Information you provide to us. Below are options for your Personal Information. If you are a California resident, a Washington resident, a Nevada resident, or a resident of the European Economic Area, you may have additional options and rights concerning your Personal Information. Please see the California Notice, the Consumer Health Data Privacy Notice, and the GDPR Notice to learn more.

Accessing, Correcting, and Deleting Your Data

You can review and change your Personal Information by logging on to your account and correcting the data.

If you wish to access or correct additional data that we hold about you and is not accessible through your account, or if you do not have an account with us, please contact us at the contact information listed in the How to Contact Us section below and we will try to assist you with your request.

Automatic Tracking Technologies

We and other third parties may use Automatic Tracking Technologies on the Services. This Privacy Notice does not apply to these third-party Automatic Tracking Technologies because we do not control the data collected by them.

You may be able to block or disable Automatic Tracking Technologies on your device at any time by changing your preferences or options menus in your browser. You may also be able to reject or delete the Automatic Tracking Technologies that are stored on your device. However, blocking, disabling, or deleting Automatic Tracking Technologies may result in some parts of the Services being inaccessible or not functioning properly.

Each browser provides different mechanisms for managing Automatic Tracking Technologies. Look at your browser's "Help" menu to determine the best way to modify your browser's Automatic Tracking Technologies storage. You can usually find these settings in the "Options" or "Preferences" menu of your browser. You can use the "Help" or similar option in your browser for more details.

To specifically find out more about cookies, including how to see what cookies have been set and how to block and delete cookies, please visit: https://www.aboutcookies.org/.

The Services may also use Google Analytics, which uses cookies or other Automatic Tracking Technologies to help us analyze how users interact with and use the Services, compile reports on activity, and provide other services related to activity and usage. Google Analytics may collect information such as your IP address, time of visit, whether you are a return visitor, and referring website. To learn more about how Google Analytics collects and processes data, you may visit http://www.google.com/policies/privacy/partners. For more information on how to opt out of Google Analytics tracking across all websites you use, visit: https://tools.google.com/dlpage/gaoptout.

Targeted Advertising

We work with certain Analytics and Advertising Providers, as described in the Whom We Share Your Personal Information With & the Purpose of Disclosure section above, and allow these Analytics and Advertising Providers through our Services to place Automatic Tracking Technologies on your browser or device to collect data about you. The data they collect may be associated with your Personal Information or they may collect data, including Personal Information, about your online activities over time and across different websites and other online services. They may use this data to provide you with interest-based (behavioral) advertising or other targeted content. We do not control these third parties' Automatic Tracking Technologies or how they may be used.

Some of our Analytics and Advertising Providers may be members of the Network Advertising Initiative ("NAI") and/or are subject to the Self-Regulatory Principles for Online Behavioral Advertising published by the Digital Advertising Alliance ("DAA"). You can obtain more information about these companies' information-collection practices and opt out of receiving interest-based advertising from participating NAI and DAA members by going to the NAI's website at http://optout.networkadvertising.org/?c=1 or the DAA's website at optout.aboutads.info. In addition, your mobile device settings may provide the functionality to limit our, or our partners', ability to engage in ad tracking or targeted advertising using the Google Advertising ID or Apple ID for Advertising associated with your mobile device.

If you opt out of targeted advertisements, you will still see advertisements online, but they may be less relevant to you. Please note that we may also work with companies that do not participate in the opt-out mechanisms described above. Even after using these opt-out mechanisms, you may receive targeted advertising from other companies. We do not control these third-party opt-out links and we do not control whether our advertising partners participate in these programs. We are not responsible for any choices you make using these programs or links or their continued availability or accuracy.

Our Email Marketing to You

If you do not wish to receive our marketing emails, you may unsubscribe by following the unsubscribe instructions at the bottom of the email or by contacting us through the contact information in the How to Contact Us section at the bottom of this Privacy Notice. After you unsubscribe, however, you may continue to receive product or service-related and other non-marketing emails. If you have provided more than one email address to us, you may continue to be contacted unless you request to unsubscribe each email address you have provided.

Do Not Track Signals

Some web browsers (including Safari, Internet Explorer, Firefox, and Chrome) incorporate a "Do Not Track" ("DNT") or similar feature that signals to websites that a user does not want to have his or her online activity and behavior tracked.

Please note that we do not recognize or respond to any signal which your browser might transmit through the DNT feature your browser might have. If you wish to disable Automatic Tracking Technologies on our Services, you should not rely on any "DNT" feature your browser might have.

Links to Other Third-Party Digital Assets

We may provide links to digital assets such as websites or applications of services that we do not own or operate ("third-party digital assets"). Those links are provided for your convenience. If you follow the link and visit those third-party digital assets, they too may collect data about you. We do not own or control any third-party digital assets, and we are not responsible for the practices employed by third-party digital assets linked to or from our Services. We recommend that you review the privacy notices of other third-party digital assets before authorizing third-party access to your data.

Children Under the Age of 18

Our Services are not directed at or intended for children under 18 years of age. No one under the age of 18 may provide any data to or on the Services. We do not knowingly collect data from children under 18. If you are under 18, do not use or provide any data on our websites or on or through any of its features/register, or in connection with the Services. If we learn we have collected or received data from a child under 18 without verification of parental consent, we will delete that data. If you believe we might have any data from or about a child under 18, please contact us through the data at the How to Contact Us section below.

International Visitors

We are based in the United States. When we obtain data about you, we may process such data outside of the country in which you reside, including in the United States and other international countries. By using the Services, you consent to the transfer to and processing of your data in countries outside of your country of residence, which may have different data protection laws than those in the country where you reside.

How to Contact Us

To ask questions or comment about this Privacy Notice and our practices in general, contact us at:

California Notice: Disclosures for California Residents

Last Updated: Jun 6, 2026

This privacy notice for California residents (the "CA Privacy Notice") supplements the information contained in the Privacy Notice of Carbon Catalyst Inc., ("Catalyst" "we," "our," "us") and applies solely to all visitors, users, and others who reside in the State of California ("consumers" or "you"). We adopt this CA Privacy Notice to comply with applicable California law, including the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020 (collectively, the "CCPA") and any terms defined in the CCPA have the same meaning when used in this CA Privacy Notice. Any other capitalized but undefined terms shall have the meanings set forth in the Catalyst Privacy Notice.

Please note that as used in this CA Privacy Notice, "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include deidentified or aggregated consumer information, publicly available information from government records, or information outside of the CCPA's scope.

Collection and Use of Personal Information

Through the Services, we have collected the following categories of Personal Information from consumers within the last 12 months and will continue to collect such Personal Information in the future:

Description of Category	What We Collect	Source	Business or Commercial Purposes for Collection
Identifiers ("Identity Data")	A real name, alias, postal address, unique personal identifier, online identifier, username, internet protocol address, email address, account name, or other similar identifiers.	Directly from You; Automatically from You; From Other Sources.	Provide products or services; Complete transactions; Manage your account; Advertise and Market to you; Analyze our website; Secure our website; Troubleshoot our website.
Personal information categories listed in the California Records statute (Cal. Civ. Code § 1798.80(e)) ("Customer Records Data")	A name, signature, physical characteristics or description, address, or telephone number.	Directly from You; From Other Sources.	Provide products or services; Complete transactions; Manage your account.
Commercial information ("Commercial Data")	Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies, including inventory, sales and customer reports, and scheduling, routes, and dispatching.	Directly from You; Automatically from You; From Other Sources.	Provide products or services; Complete transactions; Manage your account; Advertise and Market to you; Analyze our website.
Internet or other similar network activity ("Internet Use Data")	Browsing history, search history, or information on a consumer's interaction with a website, application, or advertisement.	Automatically from You.	Advertise and Market to you; Analyze our website; Secure our website; Troubleshoot our website.
Geolocation data ("Geolocation Data")	General or approximate location information, such as location and time zone derived from your IP address.	Automatically from You.	Provide products or services; Secure our mobile app; Troubleshoot our mobile app.
Sensitive Data ("Sensitive Data")	Username and password in combination with security questions or other credentials allowing access to your Catalyst Services account; precise geolocation, health data, or gender.	Directly from You.	Provide products and services; Complete transactions; Account management; Customer service.
Sensory information ("Sensory Data")	Audio recordings of telephone calls and chat sessions with our customer service team.	Directly from You.	Provide products and services; Manage your account; Troubleshoot our website.
Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer's preferences, characteristics, behavior, and predispositions. ("Inferences")	Profiles reflecting your preferences derived from usage patterns, screen recordings, and behavioral tracking data	Automatically from You; From Other Sources.	Advertise and Market to you; Analyze our website; Provide products or services.

Source Explanation
Directly from You. For example, from the forms you complete through our Services, preferences you express or provide through our Services.
Automatically From You. For example, through cookies we or our service providers set on your device as you navigate through our website.
From Other Sources. For example, other third parties who: (a) provide our e-commerce platform and related services, including hosting our online store, processing transactions, and collecting data about your interactions with our online store; (b) monitor and analyze the use of our Services; (c) provide advertising about our Services; (d) process payments on our behalf; (e) otherwise help us provide the Services to you; or (f) are our affiliates or subsidiaries.

In addition to the business or commercial purposes for collection described above, we have in the preceding 12 months collected all categories of Personal Information described above for the following purposes:

• To process your requests, purchases, payments, and transactions and to prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• For testing, research, analysis, and product development, including to develop and improve this website and our products and services.
• To create, maintain, customize, and secure your account with us.
• To deliver content and product and service offerings relevant to your interests, including targeted offers and ads through this website, third-party sites, and via email or text message (with your consent, where required by law).
• To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for such activities.
• To debug products to identify and repair errors that impair existing intended functionality.
• To help maintain the safety, security, and integrity of our Services, products, databases, other technology assets, and business.

We may also use or disclose the Personal Information we collect for one or more of the following purposes:

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred.

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Use and Disclosure of Sensitive Personal Information

We collect the following categories of sensitive personal information, as defined under the CCPA: (1) account log-in credentials (username and password) in combination with security questions or other credentials allowing access to your Catalyst Services account; (2) precise geolocation; (3) gender; and (4) health data.

We only use and disclose such information as permitted under the CCPA, including to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, and for the additional purposes enumerated in the CCPA (e.g., ensuring security and integrity, detecting security incidents, resisting malicious or fraudulent actions, and ensuring physical safety). We do not use or disclose sensitive personal information for purposes beyond those specified in the CCPA. Accordingly, we do not offer a "Right to Limit" for sensitive personal information because no such limitation is required.

Retention

The length of time we intend to retain your Personal Information is based on the category of Personal Information. We will keep your Personal Information for as long as it is necessary to provide the Services to you. Thereafter, we will keep your Personal Information for as long as is necessary to respond to any questions, complaints, or claims made by you or on your behalf, to show that we treated you fairly, or to keep records required by law.

Disclosure of Personal Information For a Business Purpose

In the preceding 12 months, we have disclosed the following categories of Personal Information for a business purpose:

• Identity Data.
• Customer Records Data.
• Commercial Data.
• Sensory Data.
• Internet Use Data.
• Geolocation Data.
• Sensitive Data.
• Inferences.

We disclose your Personal Information for a business purpose to the following categories of third parties:

• Service Providers.
• E-commerce Platform Providers.
• Marketing and Advertising Providers.
• Analytics Providers.
• Law Enforcement Authorities and Individuals in Legal Proceedings.
• Professional Advisors.
• Corporate Transactions.
• Affiliates or Subsidiaries.

Sale of Personal Information; Sharing of Personal Information for Targeted Advertising

Our use of automated tracking technology, including cookies and related technology, may be considered a sale/sharing under the CCPA.

The categories of Personal Information disclosed that may be considered a sale/sharing include:

• Identity Data.
• Commercial Data.
• Internet Use Data.

The categories of third parties to whom Personal Information was disclosed that may be considered a sale/sharing include:

• E-commerce Platform Providers.
• Marketing and Advertising Providers.
• Analytics Providers.

The business or commercial purposes for which Personal Information is sold or shared include:

• To deliver interest-based or targeted advertising to you through our websites, mobile applications, or third-party platforms;
• To measure and analyze advertising effectiveness and website traffic; and
• To understand consumer behavior and preferences to improve our Services and marketing strategies.

We do not sell or share the Personal Information of consumers who are under 18 years of age, unless we have received affirmative authorization from: (1) the consumer, if they are at least 13 years of age but under 18 years of age, or (2) the consumer's parent or guardian, if the consumer is under 13 years of age.

Rights and Choices of California Residents

The CCPA also provides California residents with specific rights regarding their Personal Information. This section describes the rights of California residents under the CCPA and explains how to exercise those rights. Certain requirements must be met for a California resident to exercise their rights, see Exercising Rights below for more information on what requirements must be met and how to exercise said rights.

Opt-Out Rights

Sale/Share of Your Information. Our use of your Personal Information may be considered a sale/sharing under CCPA. If you would like to opt out of the sale/sharing of your Personal Information you may click "Your Privacy Choices" (also found at the bottom of the page), or you may broadcast the Global Privacy Control signal through your web browser or device. More information on Global Privacy Controls can be found here. If neither of these options work for you, you may also email us at the email listed in the How to Contact Us section below.

We recognize Global Privacy Control (GPC) signals as a valid opt-out of the sale and sharing of your Personal Information and targeted advertising. When we detect a GPC signal from your browser or device, we will automatically process it as an opt-out request for the browser or device from which the signal is sent. Please note that the GPC opt-out applies to the specific browser or device from which the signal is sent and does not apply to other browsers or devices you may use. If you have an account with us, you may also submit a separate opt-out request to apply to your account across devices.

Access Rights

You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months, including:

• The categories of Personal Information we collected about you.
• The categories of sources for the Personal Information we collected about you.
• Our business or commercial purpose for collecting or selling that Personal Information.
• The categories of third parties with whom we share that Personal Information.
• The specific pieces of Personal Information we collected about you (also called a data portability request).
• If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing: sales, identifying the Personal Information categories that each category of recipient purchased; and disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.

Once we receive and confirm your consumer request, we will provide you with the requested information. See Exercising Your Rights for more information.

Data Correction Rights

You have the right to request that we correct inaccurate Personal Information that we collected from you and retained, taking into account the nature of the Personal Information and the purposes of processing the Personal Information. Once we receive and confirm your consumer request (see Exercising Your Rights for more information), we will use commercially reasonable efforts to correct the inaccurate Personal Information (and direct our service providers to correct) your Personal Information from our records, unless an exception applies.

Deletion Rights

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your consumer request (see Exercising Your Rights for more information), we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the Personal Information, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising Your Rights

To exercise the rights described below, please submit a verifiable consumer request to us by clicking this link and filling out the form or emailing us at the email provided in the Contact Information section below.

Only you, or someone legally authorized to act on your behalf, may make a "verifiable consumer request" (subsequently referred to as a "consumer request") related to your Personal Information. You may also make a consumer request on behalf of your minor child.

You may only make a consumer request for access or data portability twice within a 12-month period. To be verifiable, a consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative and that you have rights under this notice.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Making a consumer request does not require you to create an account with us, but we may require authentication of the consumer that is reasonable in light of the nature of the Personal Information requested.

We will only use Personal Information provided in a consumer request to verify the requestor's identity or authority to make the request.

Initial Request Format and Timing

We endeavor to respond to a consumer request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will cover the 12-month period preceding the consumer request's receipt. You may also request access to Personal Information collected beyond the preceding 12-month period, to the extent such information was collected on or after January 1, 2022, and doing so is not impossible or would not require a disproportionate effort on our part. If we are unable to provide information beyond the 12-month period, we will inform you of the basis for that determination. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your consumer request unless it is excessive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you with a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Other California Privacy Rights

California's "Shine the Light" law (Civil Code § 1798.83) permits users of the website who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an e-mail or write us at the email or physical address found at the end of this CA Privacy Notice under the Contact Information section.

Modification of This CA Privacy Notice

This CA Privacy Notice may be modified from time to time. The date this CA Privacy Notice was "last updated" is at the top of this page. If we make a material change to this CA Privacy Notice, we will publish the updated CA Privacy Notice to https://xds.co/pages/privacy-policy. We advise you to frequently check this CA Privacy Notice for any changes. We may also provide notice of such changes to you in other ways, at our discretion, such as by displaying a notification banner on the homepage of our website or by emailing you at the email we have on file for you.

Your use of the Services (as defined in the Privacy Notice), and continued use of the Services following any changes to this CA Privacy Notice, signifies you have read and understand the terms of this CA Privacy Notice. If you do not agree with the terms of this CA Privacy Notice, your choice is to not use the Services.

Contact Information

If you have any questions or comments about this notice, how Catalyst collects and uses your Personal Information described here and in the Privacy Notice, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us using the following contact information.

Consumer Health Data Privacy Notice

Last Updated: Jun 6, 2026

Overview

This Consumer Health Data Privacy Notice ("Health Data Privacy Notice") supplements the Privacy Notice and explains Carbon Catalyst Inc.'s, ("Catalyst", "we", "us", or "our") collection, use, and disclosure of "consumer health data" as defined under and subject to the applicable laws in the state of Washington and Nevada. This Health Data Privacy Notice applies solely to Washington and Nevada residents who interact with us in an individual or household capacity.

For more information regarding our data processing practices of non-consumer health data, please refer to our Privacy Notice.

Consumer Health Data We Collect

We may collect or receive the following categories of consumer health data through the X-LAB Bikes mobile application and other Services:

• Body and Demographic Inputs. Height, weight, and biological sex that you provide to us, which we use solely as inputs to calculate personalized cycling performance metrics.
• Fitness and Activity Metrics. Personalized cycling performance metrics, such as estimated calories burned per session.
• Precise Geolocation. Real-time geographic coordinates collected during your use of the X-LAB Bikes mobile app, used to calculate speed and elevation and to map your cycling route.
• Health Information You Provide in Communications. Health-related information you voluntarily share with us, such as physical conditions, injuries, or limitations disclosed during customer-service interactions or other correspondence.

Sources From Which We Collect Consumer Health Data

The sources from which we may collect your consumer health data are:

• Directly from you. When you enter your height, weight, and biological sex in the X-LAB Bikes app, or when you share health-related information in communications with us (e.g., customer-service inquiries).
• From your device. When the X-LAB Bikes app collects precise geolocation and cycling activity data.
• Generated by us. When we calculate fitness metrics (such as estimated calories burned) from the data described above.

Purpose for Collecting Consumer Health Data

We collect and use consumer health data for the following purposes:

• To calculate and display personalized cycling performance metrics, such as estimated calories burned.
• To determine real-time speed and elevation during cycling sessions.
• To map and display your cycling routes.
• To respond to your customer-service inquiries or other communications with us.
• To comply with legal obligations, including responses to valid legal process such as subpoenas, court orders, or regulatory demands.
• To detect or prevent fraud, security incidents, or activity that is illegal under applicable law.
• In connection with a merger, acquisition, or sale of all or substantially all of our assets, where consumer health data is among the assets evaluated or transferred.
• For other purposes with your prior consent.

What Consumer Health Data We Disclose; Whom We Disclose It To

We may disclose consumer health data to the following categories of recipients for the purposes described below:

• Service Providers. We disclose consumer health data to companies and individuals that perform services on our behalf, including cloud hosting and infrastructure providers, mapping and routing services, information technology services, and customer-support tools.
• Law Enforcement and Legal Proceedings. We may disclose consumer health data when required by valid legal process, such as a subpoena, court order, or enforceable regulatory demand, or to respond to claims related to our products or Services.
• Professional Advisors. We may disclose consumer health data to legal counsel, auditors, or other professional advisors where necessary in connection with legal claims, compliance obligations, or the professional services they provide to us.
• Corporate Transactions. We may disclose consumer health data in connection with a merger, acquisition, or sale of all or substantially all of our assets, where consumer health data is among the assets evaluated or transferred.
• With Your Consent. We may disclose consumer health data to other recipients when we have your prior consent to do so.

We may disclose any of the categories of consumer health data identified in this Health Data Privacy Notice to the recipients listed above, limited to what is necessary for the applicable purpose. We do not allow such third parties to collect or use your health data over time and across different Internet websites or online services.

We do not sell your consumer health data. If we ever intend to sell or share your consumer health data for purposes other than those described in this Health Data Privacy Notice, we will first obtain your separate, signed authorization as required by applicable law.

Your Rights

If you are a resident of Washington or Nevada, you have the right to:

• confirm whether we are collecting, sharing, or selling your consumer health data, and access such data;
• receive a list of all third parties with whom we have shared or sold your consumer health data, including an active email address or other online mechanism you may use to contact them;
• delete your consumer health data;
• withdraw your consent to our collection and sharing of your consumer health data.

How to Exercise Your Rights

You may submit a request (as provided below) to exercise any of the rights described above. You may also submit a consumer request on behalf of your minor child, or if you are a guardian or hold a similar legal authority, on behalf of the individual subject to such arrangement. The consumer request must:

• Provide sufficient information that allows us to reasonably verify that you are the person about whom we collected consumer health data.
• Describe the request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Once we receive a consumer request, we will take commercially reasonable actions to authenticate the identity of the person exercising the request, including comparing any such identification data provided against the consumer health data requested. We may authenticate a request by asking for the requestor's name, phone number, and email.

We cannot respond to your request or provide you with consumer health data if we cannot verify your identity to make the request and confirm that the consumer health data relates to you.

Making a consumer request does not require you to create an account with us, but we may require authentication of the consumer that is reasonable considering the nature of the consumer health data requested.

To exercise the rights described above, please submit a consumer request to us by clicking this link and filling out the form.

Initial Request Format and Timing

We endeavor to respond to a consumer request within 45 days of its receipt. For Nevada residents submitting access requests, we will respond within 60 days. If we require more time (for a maximum total of 90 days from receipt for Washington residents, or as otherwise permitted by Nevada law), we will notify you within the initial response period that we require more time and will provide a reason for the delay.

We do not charge a fee to process or respond to your consumer request unless the request is made more than twice in a 12‑month period. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing the request.

If we determine that we will not act on a request, we will provide a response to you that includes the basis of our reasoning. If the reasoning is our inability to authenticate the request, we will explain the efforts we took to authenticate the request and why we were unable to do so.

Appeal Response Format and Timing

If we decide that we cannot comply with your initial consumer request, you have the right to appeal our decision. Any appeal should be sent to the place where the initial consumer request was sent. The appeal should clearly indicate that it is an appeal of an initial consumer request and should include the initial consumer request along with our response explaining why we cannot comply with the initial consumer request.

We will review all appeals and provide a response within 45 days of receipt of the appeal. In our response to your appeal we will inform you of any action taken or not taken, along with an explanation of the reason in support of the response. If your appeal is unsuccessful, you can contact the appropriate regulatory enforcement authorities to submit a concern or lodge a complaint.

Non-Discrimination

We will not discriminate or retaliate against you for exercising any of your rights under applicable consumer health data privacy laws. This means we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of goods or services because you exercised your rights under this Health Data Privacy Notice.

Modification of This Health Data Privacy Notice

This Health Data Privacy Notice may be modified from time to time. The date this Health Data Privacy Notice was "last updated" is at the top of this page. If we make a material change to this Health Data Privacy Notice, we will publish the updated notice to our website. We advise you to frequently check this Health Data Privacy Notice for any changes. We may also provide notice of such changes to you in other ways, at our discretion, such as by displaying a notification banner on the homepage of our website or by emailing you at the email we have on file for you.

How to Contact Us

To ask questions or comment about this Privacy Notice and our practices in general, contact us at: