California Consumer Privacy Act / California Privacy Rights Act Notice

Effective Date: December 2025

Sit ’n Sleep, Inc. (“Sit ’n Sleep,” “we,” “us,” or “our”) values your privacy and is committed to transparency regarding how we collect, use, and disclose personal information.

This notice describes your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CPRA”), and explains how Sit ’n Sleep complies with those laws.

1. Personal Information We Collect

Depending on how you interact with us, Sit ’n Sleep may collect the following categories of personal information:

• Identifiers, such as name, email address, phone number, postal address, or customer identifier
• Commercial information, such as products purchased, leased, or considered
• Internet or other electronic network activity information, such as interactions with our website, cookies, advertising engagement, or ad impressions
• Store visit and attribution data, such as whether an advertising exposure resulted in a visit to a Sit ’n Sleep retail location, measured in an aggregated, de-identified, or pseudonymized manner
• Inferences drawn from the information above to understand customer preferences and improve our services

We collect personal information directly from you, automatically through our website and digital properties, and from service providers acting on our behalf.

Sit ’n Sleep does not knowingly collect precise geolocation data, such as real-time GPS location.

Sit ’n Sleep does not knowingly collect or process personal information relating to consumers under 16 years of age.

2. How We Use Personal Information

We use personal information for the following business and commercial purposes:

• Processing purchases, orders, and customer requests
• Providing customer service and support
• Improving our products, services, and website functionality
• Delivering relevant advertising and promotional communications
• Measuring and analyzing advertising effectiveness, including store visit attribution
• Detecting security incidents, preventing fraud, and protecting our systems
• Complying with legal and regulatory obligations

3. Advertising, Analytics, and Data Sharing

Sit ’n Sleep works with advertising, analytics, and measurement partners to deliver relevant offers and to understand the effectiveness of our marketing efforts, including whether advertising results in visits to our retail stores.

In connection with these activities, Sit ’n Sleep may disclose limited customer information — such as hashed or pseudonymized identifiers and related conversion or measurement data — to advertising and measurement partners for purposes such as advertising delivery, analytics, and aggregated store visit measurement.

Where feasible, identifiers are hashed or pseudonymized prior to disclosure, and data is handled in a privacy-protective manner consistent with applicable law and contractual restrictions.

Our current partners include LiveRamp, Google, Meta, The Trade Desk, and Klaviyo (email service provider).

These activities may also involve the collection of information regarding how users interact with our website and digital services, such as pages viewed, links clicked, or technical and usage signals necessary to operate, analyze, secure, and measure the performance of our digital properties.

Such information is used for business, operational, analytics, security, and marketing measurement purposes and is handled in accordance with applicable law and contractual limitations.

3A. Website Interactions and Communications

When you interact with our website or digital services, Sit ’n Sleep and its service providers may collect technical and usage information related to those interactions in order to operate, secure, analyze, and improve our services.

Sit ’n Sleep does not use this information to listen to, read, or record the contents of private communications in real time, and does not permit service providers to retain, use, or disclose such information for their own independent purposes.

4. Sale or Sharing of Personal Information

Sit ’n Sleep does not sell personal information for monetary consideration.

However, under California law, certain advertising and measurement activities may be considered “sharing” of personal information for purposes of cross-context behavioral advertising, even where personal information is hashed, pseudonymized, or reported in aggregated form.

California residents have the right to opt out of the sale or sharing of their personal information as described below.

Sit ’n Sleep recognizes Global Privacy Control (GPC) and similar opt-out preference signals for applicable web traffic.

5. Sensitive Personal Information

Sit ’n Sleep limits its collection and use of sensitive personal information to that which is necessary to perform services reasonably expected by consumers, to provide requested products and services, or as otherwise permitted under the CPRA.

Sit ’n Sleep does not knowingly collect sensitive personal information beyond what is necessary to provide products and services (such as government identifiers, precise location, or health-related information).

6. Your California Privacy Rights

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and share
• Request access to the personal information we maintain about you
• Request deletion of personal information, subject to legal exceptions
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of personal information
• Not be discriminated against for exercising your privacy rights

7. How to Exercise Your Rights

You may exercise your California privacy rights by:

• Clicking the “Do Not Sell or Share My Personal Information” link at the bottom of our website
• Submitting a privacy request through our designated request process
• Emailing us at feedback@sitnsleep.com
• Calling 1-800-961-1997

We may need to verify your identity before fulfilling certain requests, consistent with applicable law.

8. Data Retention

Sit ’n Sleep retains personal information only for as long as reasonably necessary to fulfill the purposes described in this notice, unless a longer retention period is required or permitted by law.

Personal information is not retained indefinitely and is subject to documented retention and deletion practices.

9. Service Providers and Contractors

Sit ’n Sleep uses service providers and contractors to process personal information on our behalf.

These parties are contractually required to:

• Use personal information only to provide services to Sit ’n Sleep
• Not retain, use, or disclose personal information for their own purposes
• Comply with applicable privacy and data protection laws, including the CPRA

10. Security Safeguards

Sit ’n Sleep maintains reasonable administrative, technical, and physical safeguards designed to protect personal information, which may include:

• Hashing or pseudonymization of identifiers where appropriate
• Secure and encrypted data transfers
• Aggregation or de-identification of measurement data where feasible
• Contractual limitations on partner data use
• Periodic review of data-handling and sharing practices
• Controls designed to limit access to website interaction data and restrict its use to authorized business purposes

11. Updates to This Notice

We may update this notice from time to time to reflect changes in our practices, technology, or legal requirements.

When we do, we will revise the “Effective Date” at the top of this notice.

We are continuing to evaluate our website technologies and may provide additional disclosures, including through a dedicated Cookies & Tracking Notice, as appropriate.

12. Contact Us

If you have questions about this notice or our privacy practices, please contact us at:

By using our Services, you agree to our Terms of Service.

30289675.1
30319281.1