Privacy Policy

Effective Date: February 13, 2026

Your privacy is important to us. We have prepared this Privacy Policy to explain how we collect, use, and disclose personal information we obtain about you when you visit our website ("Site"), sign up for our waitlist, and utilize other services offered by us (collectively, the "Services"). This Privacy Policy also explains the measures we take to safeguard the personal information and the choices available to you regarding the information. This Privacy Policy applies to all users of the Services, unless otherwise expressly indicated. The Services are provided by Cellino Biotech, Inc. ("Cellino", "we", "our", "us").

Information We Obtain

We may obtain certain personal information about you that you choose to provide to us, including any information you choose to include in your account or in communications with us. The personal information we obtain includes:

• Contact information, such as name, email and postal address, and phone number;
• Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online;
• Other personal information you provide to us, such as through emails, phone conversations, or online chats.

Information We Obtain from Social Media Platforms

We may maintain pages on social media platforms, such as LinkedIn, X/Twitter, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider's privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.

Information We Obtain by Automated Means

When you interact with our Services, we obtain certain information by automated means, such as cookies, web server logs, web beacons, and other technologies. A "cookie" is a small text file placed on your computer to identify your computer and web browser. A "web beacon," also known as an Internet tag, pixel tag or clear GIF, links web pages to web servers and cookies and may be used to transmit information collected through cookies back to a web server. We use these automated technologies on the Services to collect information about your devices, browsing actions, and usage patterns. The information we obtain in this manner may include the type of web browser you use, your device identification information, your IP address, the pages you view, and the time and duration of your visits to the Site. We use this information to help us understand how people use the Services, and to enhance the Services we offer. These technologies help us (1) remember your information so you do not have to re-enter it; (2) track and understand how you use and interact with the Services; (3) tailor the Services around your preferences; (4) measure the usability of the Services and the effectiveness of our communications; and (5) otherwise manage and enhance our Services, and help ensure they are working properly.

Most web browsers are initially set up to accept cookies. You can reset your web browser to refuse all cookies or to indicate when a cookie is being sent. Please note, however, that certain features of the Services may not work if you delete or disable cookies.

Third-Party Analytics Services

We use Posthog, a product analytics platform, to collect information about how you interact with our website. This may include pages visited, time spent on pages, clicks, scroll depth, referral sources, browser type, device type, and general geographic location (based on IP address).

Posthog is configured to gather anonymized and pseudonymized analytics about website usage. Posthog may set cookies on your browser to distinguish users and sessions. We configure Posthog to use "identified_only" person profiles, meaning individual tracking is limited to users who explicitly identify themselves (e.g., by joining our waitlist).

How We Use the Information We Obtain

We use the personal information we obtain about you to:

• Manage and process your waitlist registration;
• Provide, operate, and improve the Site and Services;
• Communicate with you about our Services, updates, announcements, and to provide customer support;
• Operate, evaluate and improve our Services (including managing the Services, developing new services and offerings; enhancing and improving our Services; managing our communications; analyzing our Services; performing data analytics; and performing accounting, auditing and other internal functions);
• Respond to your requests, questions, and feedback;
• Send you marketing communications related to the Services as permitted by law;
• Create anonymous, aggregated or de-identified data to analyze and improve the Services by ourselves or in cooperation with third parties;
• Detect, prevent, and address technical issues or security threats; and/or
• Comply with and enforce applicable legal and regulatory requirements, industry standards, and our policies and terms.

We also may use the information in other ways for which we provide specific notice at the time of collection and obtain consent to the extent required by law.

Information We Share

We do not sell your personal information. Cellino does not sell, rent, or trade your personal data to third parties for their marketing purposes.

We may share the information we obtain about you with our affiliates. In addition, we may share the information we obtain about you with service providers, professional advisors, and other entities to perform certain services on our behalf, such as hosting and maintenance of our databases and Site, data storage and management, and marketing and promotions. We do not authorize our service providers to use or disclose the information except as necessary to perform services on our behalf or comply with legal and regulatory requirements.

In addition, we may disclose personal information (1) if we are required to do so by law or legal process (such as a court order or subpoena); (2) in response to lawful requests by government agencies, such as law enforcement authorities; (3) to establish, exercise, or defend our legal rights; (4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss, or to protect the safety, property, or rights of Cellino or of any third party; (5) in connection with an investigation of suspected or actual illegal activity; or (6) otherwise with your consent.

We reserve the right to transfer any personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution, or liquidation).

Your Choices

In this section, we describe the rights and choices available to all users.

Control of personal information: You have the right to request a copy of the personal information we hold about you, the right to request that we correct any inaccurate or incomplete personal information, and the right to delete your personal information, subject to certain exceptions required by law. If you request that we delete your personal information, we may no longer be able to provide the Services to you.

Opt out of marketing communications: You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email. You may continue to receive service-related and other non-marketing emails.

Cookies & Browser Web Storage: We may allow service providers and other third parties to use cookies and similar technologies to track your browsing activity over time and across the Site and third-party websites. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Site may not work properly. Similarly, your browser settings may allow you to clear your browser web storage.

Do Not Track: Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals.

Choosing not to share your personal information: Where we are required by law to collect your personal information, or where we need your personal information in order to provide the Services to you, if you do not provide this information when requested (or you later ask to delete it), we may not be able to provide you with our Services. We will tell you what information you must provide to receive the Services by designating it as required at the time of collection or through other appropriate means.

How We Protect Personal Information

We maintain administrative, technical, and physical safeguards designed to protect personal information we obtain through the Services against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

Other Online Services and Third-Party Features

For your convenience and information, our Services may contain links to other online services, and may include third-party features such as apps, tools, widgets, and plug-ins. Our Services also may allow others to send you such links. These online services and third-party features may be owned and operated by third parties that are independent of us. A link to a third party's online service or feature does not mean that we endorse it or that we are affiliated with it. The information practices of the relevant third parties, including information they may collect about you, are subject to the privacy notices of these parties, which we strongly suggest you review. We are not responsible for the content or privacy practices of any websites, apps or services that are not owned or controlled by Cellino.

Children's Privacy

The Services are intended for users who are of the age of majority in their jurisdiction of residence. We do not knowingly collect personal information from children under the age of 18. If we become aware that we have inadvertently received personal information from a child under the age of 18, we will delete such information from our records.

Data Transfers

We may transfer the personal information we obtain about you to the United States or other countries which may not have the same data protection laws as the country in which you initially provided the information.

Additional Notice to California Users

This section only applies to residents of California and those in jurisdictions with similar rights by law.

Right to Know About Personal Information Collected, Disclosed or Sold

You have the right under the California Consumer Privacy Act ("CCPA") to request that we disclose certain information to you about our collection, use, disclosure or sale of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, and subject to certain limitations that we describe below, we will disclose such information to you.

You have the right to request any or all of the following:

• The categories of personal information we collected about you.
• The categories of sources from which the personal information is collected.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you.

Right to Request Deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records. However, we may retain personal information that has been de-identified or aggregated.

Furthermore, we may deny your deletion request if retaining the information is necessary for us or our service provider(s) to perform certain actions, such as detecting security incidents and protecting us from illegal activity.

We do not sell your personal information.

Exercising Access and Deletion

To exercise the access and deletion rights described above, please submit a request to legal@cellinobio.com.

The request should include your contact information and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. In addition, you should provide sufficient information that allows us to reasonably verify that you are the person about whom we collected the personal information. If you use an authorized agent to make request, you must provide the authorized agent written permission to do so, and we may require that you verify your identity directly with us. In order to protect the security of your personal information, we will not honor a request if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. The method used to verify your identity will vary depending on the nature of the request. You have the right not to receive discriminatory treatment for exercising any of your privacy rights.

Additional Notice to Residents of the European Economic Area ("EEA")

If you are a resident of the EEA, you have certain rights and protections under the law regarding the processing of your personal information.

Legal Basis for Processing

If you are a resident of the EEA, we will only process your personal information in the following situations:

• Where we have obtained your consent to the processing activity specified in our request.
• When we have a legitimate interest in processing your personal information. For example, we process the personal data we collect from you to add you to our waitlist, send you marketing communications, to communicate with you about our Services, or to communicate to you about our Site.
• In order to perform our responsibilities under any agreement with you.
• In order to comply with our legal or regulatory obligations (e.g., in response to legal process requests).

Data Retention

We store the information we collect about EEA residents for as long as is necessary for the purposes for which we originally collected such information. We may retain certain information for legitimate business purposes or as required by law or regulation.

Data Subject Requests

If you are a resident of the EEA, you have the right to access personal information we hold about you and to ask that your personal information be corrected. In certain cases, you may also have the right to request that we erase data we are processing or to restrict or object to certain of our processing activities. If you would like to exercise any of these rights, you may contact us at legal@cellinobio.com.

Privacy Policy Changes

We may update this Privacy Policy from time to time and without prior notice to you to reflect changes in our personal information practices. We will indicate at the top of this Privacy Policy when it was most recently updated.

Contact Us

If you have any questions or comments about this Privacy Policy, you may contact us at legal@cellinobio.com.