PRIVACY POLICY

Last updated: July 09, 2026

Data Controller

This Privacy Notice is issued by Teerapat, ("we," "us," or "our"), the data controller responsible for your personal data under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other applicable law. This Privacy Notice for Calro ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://calro.fit or any website of ours that links to this Privacy Notice
• Use Calro Coach. Calro is an all-in-one application designed to effectively meet the needs of those who want to build muscle, manage their weight, and maintain their overall health. Whether you are a fitness enthusiast, a bodybuilder, or just health-conscious: Nutrition & Macros Tracker (log and calculate daily calories and macronutrients), Workout Logger (record workout routines, sets, weights, and reps, with a rest timer between sets), Calro Nutrition Coach (a smart Calro coach that analyzes your eating habits and provides personalized weekly nutritional assessments), Water Intake Reminder (a smart tracking and reminder system for hydration), and Body Stats History (charts and tracking to monitor changes in your body weight, body measurements, and body composition)
• Engage with us in other related ways, including any marketing or events Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find out more details about any of these topics by using the table of contents below. What personal information do we process? When you visit, use, or navigate the Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use. See Section 1. Do we process any sensitive personal information? Some information is considered sensitive personal data under the PDPA — for Calro, this includes health data (e.g. body stats, nutrition, and workout information) that you provide when using the app's tracking features. We process sensitive personal information only with your explicit consent, obtained separately from other consents, or as otherwise permitted by applicable law. See Section 1. Do we collect any information from third parties? We may collect limited personal information from third parties if you choose to register or log in using a social media account (e.g., Google). See Section 6. How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. See Section 2. In what situations and with which parties do we share personal information? We may share information in specific situations and with specific categories of third parties, including service providers located outside Thailand. See Section 3. What are your rights? Under the PDPA, you have specific rights regarding your personal information, including the right to lodge a complaint with the Personal Data Protection Committee (PDPC). See Section 9. How do you exercise your rights? The easiest way is by contacting us using the details in Section 12. We will consider and act upon any request in accordance with applicable data protection laws.

TABLE OF CONTENTS

1. What Information Do We Collect? 2. How Do We Process Your Information? 3. When and With Whom Do We Share Your Personal Information? 4. Do We Use Cookies and Other Tracking Technologies? 5. Do We Offer Artificial Intelligence-Based Products? 6. How Do We Handle Your Third-Party Logins? 7. How Long Do We Keep Your Information? 8. Do We Collect Information From Minors? 9. What Are Your Privacy Rights? 10. Controls For Do-Not-Track Features 11. Do We Make Updates To This Notice? 12. How Can You Contact Us About This Notice? 13. How Can You Review, Update, or Delete The Data We Collect From You?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us. We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products, when you participate in activities on the Services (such as logging workouts, nutrition, or body stats), or otherwise when you contact us. Personal information provided by you. The personal information we collect may include:

• Name
• Email address
• Payment transaction metadata (full payment details are securely processed and stored by our payment provider) Sensitive information and explicit consent. The following categories of information are considered sensitive personal data under the PDPA:
• Health data — including body weight, body measurements, body composition, workout logs, nutrition and macro data, and hydration tracking that you enter into the app Because this is sensitive personal data, we will ask for your separate, explicit, opt-in consent before we process it — for example, via a dedicated consent step or toggle during onboarding, kept apart from your acceptance of these Terms. You may withdraw this consent at any time in the app's account settings or by contacting us (see Section 12); withdrawing consent will disable features that rely on this data (such as Body Stats History and the Calro Nutrition Coach) but will not affect the lawfulness of processing carried out before withdrawal. Payment Data. We may collect data necessary to process your payment if you choose to make purchases (e.g. subscribing to Calro), such as your payment instrument number and the associated security code. All payment data is handled and stored by Stripe, our payment processor. You may find their privacy notice at https://stripe.com/en-th/privacy/th. Social Media Login Data. We may provide you with the option to register using your existing social media or platform account (such as Google). If you choose this, we will collect certain profile information from that provider, as described in Section 6 below. All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes to such information. Information automatically collected In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you use our Services. We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This is primarily needed to maintain the security and operation of our Services, and for internal analytics and reporting. Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services, including your IP address, device information, browser type and settings, timestamps, pages and features viewed, and device event information (such as crash reports and hardware settings). Google API. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-userdata-policy).

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To provide and personalize core app features, including nutrition and macro tracking, workout logging, AI-generated nutritional assessments, water intake reminders, and body stats history.
• To respond to user inquiries and offer support.
• To request and act on feedback.
• To evaluate and improve our Services, products, marketing, and your experience.
• To identify usage trends and better understand how our Services are used.
• To process your payments and manage your subscription.
• To comply with our legal obligations.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following categories of third parties, including recipients located outside Thailand. Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf. The categories of third parties we may share personal information with include:

• AI Platforms (e.g. providers powering the Calro Nutrition Coach)
• Cloud Computing Services
• Data Storage Service Providers
• Data Analytics Services
• Finance & Accounting Tools
• Payment Processors We also may need to share your personal information in the following situations:
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. Cross-Border Data Transfers Some of the third parties described above — including our cloud hosting, AI, and analytics providers — may store or process your personal information on servers located outside Thailand (for example, in the United States or Singapore). Where we transfer your personal information internationally, we will do so only where the destination country or organization is recognized as having adequate data protection standards, or where we have put in place appropriate safeguards required under the PDPA, such as standard contractual clauses or binding corporate rules with the recipient, or where the transfer falls within an exemption permitted by law (for example, if the transfer is necessary to perform our contract with you). You may contact us using the details in Section 12 to request more information about these safeguards.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information. We may use cookies and similar tracking technologies (like web beacons and pixels) on our website to gather information when you interact with our Services. Some of these help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic app functions. Google Analytics. We may share your information with Google Analytics to track and analyze use of the Services. You can opt out of being tracked by Google Analytics across the Services at https://tools.google.com/dlpage/gaoptout. For more information on Google's privacy practices, visit the Google Privacy & Terms page. Google Analytics. We may share your information with Google Analytics to track and analyze use of the Services. You can opt out of being tracked by Google Analytics across the Services at https://tools.google.com/dlpage/gaoptout. For more information on Google's privacy practices, visit the Google Privacy & Terms page.

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies — including Calro's Calro Nutrition Coach. As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience, primarily through our Calro Nutrition Coach, which analyzes your logged eating habits and provides personalized weekly nutritional assessments. Use of AI Technologies We provide the AI Products through third-party service providers ("AI Service Providers"), which may include Google Cloud AI and/or other AI model providers. As outlined in this Privacy Notice, your input, output, and personal information (including relevant nutrition and health data you have logged) will be shared with and processed by these AI Service Providers, which may be located outside Thailand (see Cross-Border Data Transfers in Section 3), to enable your use of our AI Products. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider. Our AI Products Our AI Products are designed for the following functions:

• AI applications
• Text analysis
• AI document generation (e.g. personalized nutritional assessments) How We Process Your Data Using AI All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties, in order to safeguard your data throughout the process. AI-generated nutritional assessments are intended for general informational purposes only and do not constitute medical advice; please consult a qualified healthcare professional before making significant changes to your diet or exercise routine.

6. HOW DO WE HANDLE YOUR THIRD-PARTY LOGINS?

In Short: If you choose to register or log in to our Services using a third-party account, we may have access to certain information about you. Our Services offer the ability to register and log in using your Google account. Where you choose to do this, we will receive certain profile information about you from Google, which may include your name, email address, and profile picture. We will use this information only for the purposes described in this Privacy Notice or otherwise made clear to you. We do not control, and are not responsible for, other uses of your personal information by your third-party account provider. We recommend reviewing their privacy notice to understand how they collect, use, and share your personal information.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless otherwise required by law. We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us to keep your personal information for longer than the period of time in which users have an account with us, No purpose in this notice will require us to keep your personal information for longer than the period of time in which users have an account with us. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible, securely store it and isolate it from further processing until deletion is possible.

8. DO WE COLLECT INFORMATION FROM MINORS? In Short: We do not knowingly collect data from or market to children under 18 years of age. We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we

knowingly sell such personal information. By using the Services, you represent that you are at least this age, or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from underage users has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under this age, please contact us at support.calro@gmail.com.

9. WHAT ARE YOUR PRIVACY RIGHTS? In Short: Under the Personal Data Protection Act B.E. 2562 (PDPA), you have specific rights regarding your

personal information. Subject to applicable law and certain exceptions, you have the right to:

• Right to be informed — know how and why your personal data is processed (as set out in this Notice).
• Right of access — request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification — request that we correct inaccurate or incomplete personal data.
• Right to erasure — request that we delete your personal data, subject to legal retention requirements.
• Right to restrict processing — request that we suspend the processing of your personal data in certain circumstances.
• Right to data portability — request that we transfer your personal data to you or to a third party in a structured, commonly used, machine-readable format, where technically feasible.
• Right to object — object to our processing of your personal data in certain circumstances, including for direct marketing.
• Right to withdraw consent — withdraw any consent you have given us at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint — file a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand if you believe we have processed your personal data unlawfully. To exercise any of these rights, please contact us using the details in Section 12. We will respond to your request within the timeframe required by the PDPA. We may need to verify your identity before acting on your request. Account Information If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized, and we do not currently respond to DNT browser signals. You may still control cookies directly through your browser settings.

11. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws. We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes within the app or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to stay informed of how we are protecting your information.

12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions, comments, or requests regarding this notice or your personal data, you may contact us at: Email: support.calro@gmail.com You may also lodge a complaint with the Office of the Personal Data Protection Committee (PDPC), Thailand, if you believe your rights under the PDPA have been violated.

13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the PDPA and other applicable laws, you have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us at support.calro@gmail.com.