Concierge Drop Privacy Statement

Introduction

Welcome to Concierge Drop, a service of Varsity Valet & Linen Cleaners NYC LLC ("we," "us," or "our"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use our website, place orders, or communicate with us via SMS or other channels. By using our services, you agree to the practices described in this policy.

This policy applies to all residents, customers, building contacts, and visitors who interact with Concierge Drop. If you have questions, contact us at [email protected] or 656-560-5001.

Information We Collect

a. Personal Data

• First and last name
• Email address
• Phone number
• Building address and unit number
• Physical delivery address

b. Order and Preference Data

• Information about your orders and service preferences, including laundry preferences, cleaning instructions, scheduling preferences, and special requests.

c. Payment Data

• We collect payment information necessary to process transactions. All payment card data is handled directly and securely by Stripe, our third-party payment processor. Stripe encrypts and stores your card information on their secure servers — Concierge Drop has no access to your full credit card number at any time. We retain only transaction records (amount, date, and service type) for billing and recordkeeping purposes.

d. Communications Data

• When you contact us via SMS, email, or phone, we retain records of those communications to fulfill your orders, resolve issues, and improve our service.

e. Usage Data

• Data on how you access and interact with our website and services, including device type, browser type, IP address, and pages visited.

f. Cookies and Tracking Technologies

• Our website uses cookies and similar tracking technologies to analyze traffic, remember preferences, and improve user experience. You may disable cookies through your browser settings, though some features of the site may not function properly as a result. We do not use cookies for cross-site behavioral advertising.

How We Use Your Information

• To provide, manage, and fulfill service orders
• To send order updates, appointment reminders, and service communications via SMS and email
• To process payments and maintain billing records
• To respond to customer inquiries and provide support
• To analyze aggregate service usage and improve operations
• To detect, prevent, and address technical issues or security concerns
• To comply with legal obligations

AI-Assisted Communications (Planned Future Capability) Concierge Drop may in the future use AI-assisted tools to help draft responses to customer inquiries and service requests. If and when this capability is implemented, all AI-generated drafts will be reviewed by a human team member before being sent to you. We will update this policy prior to activating any AI processing of your personal communications.

SMS Communications and Consent

By opting in to receive SMS messages from Concierge Drop, you consent to receive service-related messages including order confirmations, pickup and delivery updates, appointment reminders, and customer support communications.

We do not share or sell phone numbers, SMS opt-in consent, or any personal data to third parties for marketing purposes.

You may opt out at any time by replying STOP to any message. For support, reply HELP. Message and data rates may apply. Messaging frequency may vary.

Data Sharing

We do not sell your personal information. We may share data only in the following limited circumstances:

a. Service Providers

We work with third-party vendors who assist in operating our services. These vendors are contractually required to protect your data and may only use it to perform services on our behalf. Current service providers include:

• Stripe — payment processing
• RingCentral — SMS and customer communications
• SendGrid — email delivery
• CleanCloud — order and driver management
• HubSpot — customer relationship management
• QuickBooks — invoicing and financial recordkeeping
• Amazon Web Services / Supabase — cloud infrastructure and data storage

b. Field Service Vendors

• To fulfill your service orders, we share relevant order details (such as your name, unit number, and service type) with the independent service providers we dispatch on your behalf, including dry cleaners, home cleaners, dog walkers, and other vendors. These vendors receive only the information necessary to complete your order.

c. Property Management Partners

• We share aggregated, anonymized service utilization data (such as total order volume and service category usage) with the property management companies of the buildings we operate in. This data does not include resident names, unit numbers, individual order details, or any personally identifiable information.

d. Legal Obligations

• We may disclose personal information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Concierge Drop, our customers, or others.

e. Building Staff Referral Program

• Concierge Drop operates a referral program through which building staff members (doormen, concierges, superintendents, and porters) may refer residents to our services. When a staff member participates in this program, we collect their name, role, and phone number for the purpose of tracking referrals and delivering referral credits via SMS. This information is stored in our systems, used only for program administration, and is never shared with third parties for marketing purposes. Staff members may opt out of the referral program at any time by contacting us at [email protected].

f. Business Transfers

• In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website prior to any such transfer.

Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy, including for legal, accounting, and business continuity purposes. Specifically:

• Order and transaction records: Retained for a minimum of 7 years for tax and accounting compliance
• SMS and communication logs: Retained for up to 2 years
• Account and profile data: Retained until you request deletion or your account has been inactive for 3 years

When data is no longer needed, it is securely deleted or anonymized.

Data Security

We take commercially reasonable measures to protect your personal data, including SSL/TLS encryption in transit, encrypted data storage, role-based access controls, and restricted access to sensitive systems. Our platform uses Row Level Security (RLS) policies to ensure that no user can access data beyond their authorized scope.

In the event of a data breach that affects your personal information, we will notify you as required under applicable law, including the New York SHIELD Act, within the legally required timeframe. Notification will be provided via email to the address on file or by prominent notice on our website.

Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that inaccurate or incomplete data be updated
• Deletion: Request that we delete your personal data, subject to legal retention requirements
• Restriction: Request that we limit how we process your data in certain circumstances
• Opt-out of marketing: Unsubscribe from marketing communications at any time

To submit any of these requests, email us at [email protected] with the subject line "Privacy Request." We will respond within 30 days.

California Residents — CCPA/CPRA

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete your information, and the right to opt out of the sale or sharing of your personal information.

We do not sell or share personal information for cross-context behavioral advertising purposes. To exercise your California privacy rights, contact us at [email protected].

Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].

Data Storage and Transfers

Your data is stored and processed on servers located in the United States, primarily through Amazon Web Services infrastructure. If you access our services from outside the United States, please be aware that your information may be transferred to and processed in the U.S., where data protection laws may differ from those in your country.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Any material changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. Continued use of our services after updates constitutes acceptance of the revised policy.

Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: [email protected]
• Phone: 656-560-5001
• Mailing Address: Concierge Drop (Varsity Valet & Linen Cleaners NYC LLC), 305 East 40th Street, Unit 10R, New York, NY 10016