Last Updated: July 14, 2026

This Privacy and Cookie Policy explains how Slingshot Biosciences, Inc. (“Slingshot,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you interact with our websites, online store, forms, communications, events, and related services that link to this Policy (collectively, the “Services”). It also explains how we use cookies and similar technologies and the rights and choices that may be available to you.

Slingshot primarily provides products and services to businesses and research organizations. Personal information relating to business representatives remains personal information and is handled as described in this Policy. Additional or supplemental notices may apply to particular products, programs, transactions, or relationships. If a supplemental notice conflicts with this Policy, the supplemental notice will control for the covered processing.

This Policy does not apply to personal information processed solely on behalf of a customer under a written agreement where Slingshot acts as a service provider or processor, or to employee and job-applicant information covered by a separate workforce or applicant notice.

For personal information that Slingshot processes for its own purposes, Slingshot is the controller under the GDPR and UK GDPR and the business under the CCPA, in each case to the extent the applicable law applies.

1. California Notice at Collection

For California residents, this Section provides a notice at collection. During the preceding 12 months, we may have collected the following categories of personal information: identifiers; customer-record information; commercial information; internet or other electronic network activity; approximate geolocation information; professional or employment-related information; inferences; and limited sensitive personal information, such as account credentials or payment information handled through payment service providers. We collect this information for the purposes described in Sections 4 and 14, including to operate and secure the Services, respond to inquiries, process transactions, provide support, communicate and market, analyze performance, comply with law, and protect our rights.

We do not sell personal information for money. Depending on the cookies you permit and how third-party services are configured, disclosures of identifiers, internet or network activity, approximate location, and related inferences to advertising or analytics partners may be considered a “sale,” “sharing,” or use for targeted advertising under certain U.S. state privacy laws. You may opt out at any time by selecting Cookie Settings in the footer of www.slingshotbio.com and disabling the applicable non-essential cookie categories. We also honor legally recognized opt-out preference signals, such as Global Privacy Control, as described in Section 6.

We retain each category only for as long as reasonably necessary and proportionate for the disclosed purposes, subject to the criteria and representative periods in Section 8. Additional California disclosures appear in Section 14.

2. Personal Information We Collect

2.1 Information You Provide

We may collect personal information that you provide directly to us, including:

• Contact and business information, such as name, business email address, telephone number, mailing address, company or institution, job title, department, and country or region.
• Account information, such as username, password or other authentication credentials, account preferences, and account activity.
• Transaction and commercial information, such as products or services requested or purchased, order history, billing and shipping details, tax-exemption information, and related records. Payment card and bank information is generally collected and processed by our payment service providers rather than stored by Slingshot.
• Communications and support information, such as inquiries, quote requests, feedback, technical-support communications, and other correspondence.
• Marketing and event information, such as newsletter preferences, event or webinar registrations, survey responses, and engagement with our communications.
• Any other information you choose to provide or that we request with an appropriate notice.

2.2 Information Collected Automatically

When you use the Services, we and our service providers may automatically collect information about your device and activity, including:

• IP address, browser type and version, device type, operating system, language, device identifiers, screen resolution, and similar technical information.
• Pages viewed, links clicked, referring and exit pages, dates and times of access, session duration, navigation paths, interactions with forms or content, and similar usage information.
• General location inferred from IP address, such as city, state, province, or country. We do not intend to collect precise geolocation through the public website.
• Cookie identifiers, advertising identifiers, pixels, tags, local storage, and information collected through similar technologies, as described in Section 6.

2.3 Information from Third Parties

We may obtain personal information from distributors, business partners, event organizers, marketing partners, social-media platforms, service providers, publicly available sources, and data providers. For example, a distributor or event organizer may provide business contact information when you request information about Slingshot products, or a social-media platform may provide information about your interaction with our page or advertising, subject to your settings and the platform’s policies.

2.4 Sensitive Information and Regulated Data

The public Services are not designed to collect protected health information, patient-identifiable information, genetic information, or other special-category or highly sensitive information. Please do not submit patient information, clinical data that identifies an individual, government identification numbers, precise geolocation, or other sensitive information through general website forms or email unless Slingshot expressly requests it and provides an appropriate notice or agreement. If we receive such information inadvertently, we may delete it or process it only as permitted by applicable law.

3. Sources of Personal Information

We collect personal information from the following categories of sources:

• You, including through the Services, orders, forms, events, email, telephone, and other communications.
• Your employer, institution, colleagues, authorized purchasers, or other representatives.
• Our distributors, resellers, business partners, event sponsors, and referral sources.
• Our service providers, including website, e-commerce, payment, shipping, analytics, customer-relationship-management, marketing, and support providers.
• Social-media platforms, advertising networks, and other third-party websites or services.
• Publicly available sources and data providers.

4. How We Use Personal Information and Our Legal Bases

We use personal information for the purposes below. For individuals in the European Economic Area (“EEA”), United Kingdom (“UK”), or other jurisdictions that require a legal basis, the applicable bases are identified in the table. More than one basis may apply depending on the context.

Where we rely on legitimate interests, those interests include operating and improving our business and Services; serving customers and business contacts; protecting systems, rights, and safety; preventing fraud; conducting responsible business-to-business marketing; and managing corporate transactions. We consider and balance those interests against the rights and interests of affected individuals.

We may create aggregated or deidentified information and use it for lawful purposes. We maintain deidentified information in deidentified form and do not attempt to reidentify it except to test or validate deidentification or as otherwise permitted by law. Pseudonymized information remains personal information where it can be linked to an individual using additional information.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described in this Policy:

• Service providers and contractors that support website hosting, e-commerce, payment processing, shipping, customer support, communications, information technology, security, analytics, marketing, customer-relationship management, data storage, and other business operations.
• Advertising, analytics, and social-media partners, subject to your cookie choices and applicable law. Certain disclosures may be considered a sale, sharing, or targeted advertising under U.S. state privacy laws, as described in Sections 6 and 14.
• Distributors, resellers, and business partners when necessary to respond to your request, support a transaction, coordinate service, or pursue a business relationship, and where permitted by law.
• Affiliates and related entities for purposes consistent with this Policy.
• Professional advisers, auditors, insurers, financing sources, and other parties subject to appropriate duties of confidentiality.
• Government authorities, regulators, courts, law enforcement, and other parties when required by law or reasonably necessary to protect rights, safety, and property; investigate unlawful activity; or establish, exercise, or defend legal claims.
• Actual or prospective parties to a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to appropriate protections.
• Other parties at your direction or with your consent.

We require service providers and contractors to process personal information only for specified purposes and to provide protections required by applicable law. Some third parties, such as social-media platforms and advertising providers, may act as independent businesses or controllers for information they receive and will process it under their own privacy notices.

6. Cookies and Similar Technologies

6.1 What These Technologies Are

Cookies are small text files stored on your device. We and third parties may also use pixels, tags, web beacons, software development kits, local storage, session storage, and similar technologies on the Services and in electronic communications. In this Policy, we refer to these technologies collectively as “cookies.”

6.2 Cookie Categories

The categories below describe the cookies that may be used. The specific cookies, providers, purposes, and durations currently in use are identified in the Cookie Settings tool available through the footer of www.slingshotbio.com. That tool is the most current source for the website’s active cookie inventory.

6.3 Cookie Settings and Consent

You may review and change your cookie choices at any time by selecting Cookie Settings in the footer of www.slingshotbio.com. The control reopens our consent-management tool and allows you to accept, reject, or adjust non-essential cookie categories. Withdrawing consent does not affect processing that occurred before withdrawal. Strictly necessary cookies remain active because they are required to provide requested functions, maintain security, or remember your choices.

Where applicable law requires prior consent, including in the EEA and UK, we do not place or access non-essential cookies until you have made an affirmative choice. The consent tool provides an option to reject non-essential cookies and category-level controls. We may ask you to renew your choices periodically or when material changes are made.

You can also configure your browser to block, alert you to, or delete cookies. Browser controls may affect only that browser and device, and blocking strictly necessary cookies may impair the Services. You may opt out of Google Analytics through Google’s browser add-on where available, but Cookie Settings is the primary mechanism for controlling cookies on our Services.

6.4 Global Privacy Control and Do Not Track

Where required by applicable law, we treat a recognized browser-based opt-out preference signal, such as Global Privacy Control (“GPC”), as a request to opt out of the sale or sharing of personal information and targeted advertising for the browser and device that sends the signal. A GPC signal may not apply to information associated with a different browser, device, or account unless the law requires otherwise.

Some browsers transmit “Do Not Track” signals. Because no uniform legal or technical standard currently governs ordinary Do Not Track signals, the Services do not respond to them unless required by law. This does not affect our treatment of GPC or other legally recognized opt-out preference signals.

6.5 Third-Party Technologies

Third-party providers may collect information through cookies for their own purposes, subject to your choices and their privacy notices. Providers that may appear in Cookie Settings include Google, LinkedIn, Meta, HubSpot, Intercom, Hotjar, and other vendors used from time to time. We do not control a third party’s processing after information is lawfully provided to it as an independent business or controller.

7. Marketing Choices

You may unsubscribe from marketing emails by using the unsubscribe link in the message or contacting privacy@slingshotbio.com. We may continue to send transactional, account, support, legal, or other non-marketing communications. Where direct-marketing processing is based on legitimate interests, you may object at any time. Where it is based on consent, you may withdraw consent at any time.

8. Data Retention

We retain personal information only for as long as reasonably necessary and proportionate for the purposes described in this Policy, including to provide the Services, maintain business and transaction records, comply with law, resolve disputes, enforce agreements, protect security, and exercise or defend legal claims. Representative periods are below. Actual periods may be shorter or longer based on the circumstances and legal requirements.

When information is no longer required, we delete it, anonymize or deidentify it, or securely isolate it until deletion is practicable, subject to lawful backup and archival practices.

9. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, use, alteration, disclosure, or destruction. Safeguards may include access controls, authentication, encryption where appropriate, vendor diligence, security monitoring, vulnerability management, personnel controls, and incident-response procedures. No system or transmission method is completely secure, and we cannot guarantee absolute security.

If a security incident affects personal information, we will investigate and provide notices to affected individuals, regulators, or other parties when and as required by applicable law.

10. International Data Transfers

Slingshot is based in the United States, and personal information may be transferred to and processed in the United States and other countries where we or our service providers operate. Those countries may have privacy laws that differ from the laws where you live.

Where required for transfers from the EEA, UK, or Switzerland, we use an applicable lawful transfer mechanism, which may include an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, contractual and technical safeguards, or another mechanism permitted by law. You may contact us to request additional information about applicable safeguards, subject to necessary redactions and legal limitations.

11. Your Privacy Rights and How to Exercise Them

11.1 Submitting a Request

Depending on where you live and subject to legal exceptions, you may have rights to access or know about personal information; obtain a copy; correct inaccurate information; delete information; restrict or object to processing; withdraw consent; obtain portability; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; and appeal a decision on a request.

You may submit a privacy request through any of the following methods:

• Email: privacy@slingshotbio.com
• Online: submit the form at https://www.slingshotbio.com/contact and state “Privacy Request” in your message.
• Telephone: +1 510 770 6806, Monday through Friday, 8:00 a.m. to 6:00 p.m. Pacific Time, excluding holidays.

For cookie-related choices, select Cookie Settings in the footer of www.slingshotbio.com. For sale, sharing, and targeted-advertising opt-outs, you may also use a legally recognized opt-out preference signal such as GPC.

We may need to verify your identity and authority before completing a request. Verification may require matching information you provide with information we maintain or requesting additional information reasonably necessary to prevent fraud. We will use verification information only for that purpose. If we cannot verify a request, we may deny it or limit our response as permitted by law.

An authorized agent may submit a request where permitted. We may require proof of the agent’s authority and may ask you to verify your identity or confirm directly that you authorized the request, unless the agent holds a valid power of attorney recognized under applicable law.

We will respond within the period required by applicable law. We may extend the response period when permitted and will explain the reason. We will not discriminate against you for exercising a privacy right. Some rights are subject to exceptions, including where information is needed to complete a transaction, comply with law, protect security, or establish, exercise, or defend legal claims.

11.2 EEA and UK Rights

If the GDPR or UK GDPR applies, you may have the right to:

• Access personal data and receive information about its processing.
• Correct inaccurate or incomplete personal data.
• Request deletion in circumstances provided by law.
• Restrict processing in circumstances provided by law.
• Object to processing based on legitimate interests and object at any time to direct marketing.
• Receive personal data in a structured, commonly used, machine-readable format and transmit it to another controller where the portability right applies.
• Withdraw consent at any time, without affecting processing lawfully conducted before withdrawal.
• Lodge a complaint with a supervisory authority. EEA authority information is available through the European Data Protection Board. UK individuals may complain to the UK Information Commissioner’s Office.

We do not use personal data to make solely automated decisions that produce legal effects or similarly significant effects concerning you. We may use ordinary analytics, audience selection, or marketing segmentation that does not have such effects.

11.3 Other U.S. State Rights

Residents of certain U.S. states may have rights to access, correct, delete, or obtain a portable copy of personal information and to opt out of sale, targeted advertising, or qualifying profiling. Submit requests using the methods above. If applicable law provides a right to appeal our decision, you may appeal by replying to our decision or emailing privacy@slingshotbio.com with “Privacy Appeal” in the subject line. We will respond to the appeal as required by applicable law.

12. Third-Party Websites and Services

The Services may link to websites, platforms, payment services, social networks, or other services operated by third parties. Their privacy practices are governed by their own notices, not this Policy. A link does not imply that Slingshot controls or endorses the third party’s privacy practices.

13. Children’s Privacy

The Services are intended for business and professional users and are not directed to children under 16. We do not knowingly collect personal information from children under 16 through the Services. We do not knowingly sell or share personal information of individuals under 16. If you believe a child has provided personal information, contact us so that we can take appropriate action.

14. Additional California Disclosures

This Section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), applies to Slingshot and the relevant information.

14.1 Categories Collected, Sources, Purposes, and Disclosures

The following table describes categories of personal information that we may have collected during the preceding 12 months. The examples are illustrative and may not reflect information about every individual.

We do not intentionally collect protected classifications, biometric information used for identification, precise geolocation, education information, or the contents of private communications through the public Services, except if you voluntarily provide information in a context where it is relevant and lawfully processed.

14.2 Sale, Sharing, and Targeted Advertising

Slingshot does not sell personal information for monetary consideration. During the preceding 12 months, depending on cookie configuration and user choices, we may have disclosed identifiers, internet or electronic network activity, approximate geolocation, and inferences to advertising, analytics, or social-media partners in a manner that may be considered a “sale” or “sharing” under the CCPA. The business or commercial purposes are advertising, campaign measurement, audience development, analytics, and service improvement.

To opt out, select Cookie Settings in the footer of www.slingshotbio.com and disable advertising, targeting, or other applicable non-essential categories. You may also submit an opt-out request using the methods in Section 11 or enable GPC. We do not knowingly sell or share personal information of consumers under 16.

14.3 Sensitive Personal Information

We use and disclose sensitive personal information only for purposes permitted without offering a right to limit, such as authenticating users, processing requested transactions, preventing fraud, maintaining security, and providing requested services. We do not use sensitive personal information to infer characteristics about individuals or for purposes that require a “Limit the Use of My Sensitive Personal Information” link. If our practices change, we will update this Policy and provide the required method to exercise the right to limit.

14.4 California Rights

Subject to exceptions, California residents may have the following rights:

• Right to know the categories and specific pieces of personal information collected, sources, purposes, and categories of third parties to whom information is disclosed, sold, or shared.
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information.
• Right to limit use and disclosure of sensitive personal information when the right applies.
• Right to receive information about and opt out of certain automated decision-making technologies when applicable law grants that right.
• Right not to receive discriminatory treatment for exercising CCPA rights.

California requests may be submitted and will be verified as described in Section 11. We may deny or limit a request where permitted by law and will explain our decision. California residents may use an authorized agent as described in Section 11.

14.5 Financial Incentives

We do not currently offer a financial incentive or price or service difference in exchange for the collection, retention, sale, or sharing of personal information. If we introduce such a program, we will provide a separate notice and obtain any consent required by law.

14.6 California Direct-Marketing Disclosure

California Civil Code Section 1798.83 may permit California residents to request information regarding certain disclosures of personal information to third parties for their own direct-marketing purposes. Slingshot does not disclose personal information to third parties for their independent direct marketing without providing choices required by law. Questions may be submitted to privacy@slingshotbio.com.

15. Changes to This Policy

We may update this Policy to reflect changes in our practices, technologies, legal requirements, or other circumstances. We will post the updated Policy and revise the “Last Updated” date. If required by law, we will provide additional notice or obtain consent before applying a material change to personal information already collected. We encourage you to review this Policy periodically.

16. Contact Us

Questions, complaints, and privacy requests may be directed to:

Slingshot Biosciences, Inc.

1250 45th Street, Suite 100

Emeryville, California 94608, USA

Email: privacy@slingshotbio.com

Telephone: +1 510 770 6806 (Monday through Friday, 8:00 a.m. to 6:00 p.m. Pacific Time, excluding holidays)

Website: https://www.slingshotbio.com

Individuals in the EEA may lodge a complaint with the supervisory authority in the country where they live, work, or believe an infringement occurred. Individuals in the UK may lodge a complaint with the UK Information Commissioner’s Office. We encourage you to contact us first so that we can address your concern.