COLORADO PRIVACY NOTICE (CPA) – NAVIENMATE

Last Updated: April 10, 2026

This Colorado Privacy Notice supplements NavienMate’s Privacy Policy and applies solely to residents of the State of Colorado. NavienMate (“we,” “us,” or “our”) complies with the Colorado Privacy Act (“CPA”).

I. PERSONAL DATA WE COLLECT

Depending on how you interact with NavienMate, we may collect the following categories of personal data:

• Identifiers (such as device ID)
• Commercial information (including bed warmer purchases and order history)
• Internet and application activity (including app usage and interactions)
• Precise geolocation data (GPS latitude and longitude)
• Sensitive personal data collected through optional application features, including sleep‑related information and breathing sound data, when expressly enabled by the user

Sensitive personal data is collected only with affirmative consent and only for the purposes described below.

II. SOURCES OF PERSONAL DATA

We collect personal data from the following sources:

• Directly from you (e.g., checkout forms and application inputs)
• Indirectly through cookies and similar technologies
• Third‑party vendors (such as payment processors)
• NavienMate iOS and Android applications (e.g., device ID, push notification tokens)
• Optional application features expressly enabled by the user, including Navien OptiSleep

III. BUSINESS PURPOSES FOR PROCESSING

We process personal data for the following business purposes:

• E‑commerce processing and payment fulfillment
• Shipping and delivery of products
• Customer service, returns, and warranty support
• Marketing and promotional communications (where permitted by law)
• Fraud prevention and security monitoring
• Providing optional sleep‑related analysis and automated comfort features through application functionality
• Operating, maintaining, and improving application features, including OptiSleep
• Internal analytics and product development based on aggregated usage data
• Legal and regulatory compliance

IV. THIRD PARTIES WITH WHOM WE SHARE PERSONAL DATA

We may share personal data with the following categories of third parties:

• Payment processors
• Shipping and logistics providers
• Marketing, analytics, and communications service providers
• Service providers supporting optional application features (including sleep data analytics providers), acting solely on NavienMate’s behalf.

NavienMate does not sell personal data.

V. DATA RETENTION

We retain personal data only for as long as reasonably necessary to fulfill the purposes described in this Notice, including:

• Order records, as required for warranty, accounting, and tax compliance
• Customer service inquiries, retained for a limited period following resolution
• Information subject to legal holds or dispute resolution

Personal data collected through optional application features such as Navien OptiSleep is retained until service termination or withdrawal of consent, unless a longer retention period is required or permitted by law.

VI. YOUR RIGHTS UNDER THE COLORADO PRIVACY ACT

Colorado residents have the following rights, subject to certain exceptions:

• The right to access personal data
• The right to correct inaccuracies in personal data
• The right to delete personal data
• The right to data portability
• The right to opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects
• The right to appeal our response to a privacy rights request
• The right to non‑discrimination for exercising privacy rights

NavienMate processes sensitive personal data, including sleep‑related information, only with the consumer’s affirmative consent. Consumers may withdraw consent at any time.

VII. CPA UPDATES EFFECTIVE 2025

NavienMate complies with amendments to the Colorado Privacy Act effective in 2025, including:

• Biometric Identifiers:
  NavienMate does not collect biometric identifiers as defined under the Colorado Privacy Act. Breathing sound data processed through optional features such as Navien OptiSleep is not used for biometric identification or identity verification purposes.
• Minors Under 18:
  NavienMate does not knowingly sell personal data or conduct targeted advertising directed at children. Where applicable, affirmative consent mechanisms are used as required by law.
• Global Privacy Control (GPC):
  Global Privacy Control signals are automatically honored for applicable opt‑out requests.

VIII. SUBMITTING A REQUEST

Colorado residents may submit privacy requests using the following methods:

• Phone: 877‑689‑1541
• Email: info@navienmate.com
• Online: Contact Us page

Verification: Name, email address, physical address, and Colorado residency
Response Time: 45 days (with one 45‑day extension where permitted by law)