Ciphertext Solutions Privacy Policy

This Privacy Policy applies to personal information we collect through the Services and through offline interactions with us (such as at events, by telephone, or through paper forms), unless a separate privacy notice is provided at the point of collection. This Policy does not apply to information collected by third-party websites, applications, or services that may link to or be accessible from our Services. We are not responsible for the privacy practices of such third parties.

Our Services may contain links to websites, applications, or services operated by third parties. We do not control these third-party sites and are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

Your use of our Services is also governed by our Terms of Use, which are incorporated by reference into this Privacy Policy.

If you have questions about this Privacy Policy or our privacy practices, please contact us using the information provided in Section 12 below.

We collect personal information that you voluntarily provide to us, including when you:

• Create an account or profile
• Request information about our products or services
• Contact us for customer support
• Subscribe to our communications
• Participate in surveys, contests, or promotions
• Apply for employment
• Otherwise communicate with us

This information may include: name, email address, phone number, mailing address, employment information (including institution, title, and professional credentials), account credentials (username and password), payment and billing information, communication preferences, survey responses, and any other information you choose to provide.

We automatically collect certain information about your device and how you interact with our Services, including:

• Device information (such as device type, operating system, browser type and version, and unique device identifiers)
• Network and internet connection information (including IP address and internet service provider)
• Usage information (such as pages viewed, features used, time spent on Services, search queries, and referring websites)
• Location information (including general location derived from IP address and, with your consent where required by law, precise location from GPS or similar technologies)
• Log data and analytics information

We collect this information through various technologies, including cookies, web beacons, pixels, and similar tracking technologies, as described further in Section 5.

We may receive personal information about you from third parties, including:

• Service providers and vendors who provide services to us
• Business partners and affiliates
• Advertising and marketing partners
• Data providers and aggregators
• Publicly available sources
• Social media platforms (if you interact with us through social media)
• Other users of our Services (such as when they provide your contact information for referrals)

In certain circumstances, we may collect categories of personal information that are considered "sensitive" under applicable laws, such as:

• Precise geolocation information (collected only with your consent where required by law)
• Account login credentials
• Payment card information (processed by our payment processors)

We limit our collection and use of sensitive personal information to purposes that are necessary to provide the Services and for other purposes permitted under applicable law. We do not use or disclose sensitive personal information for purposes beyond those permitted uses.

• Providing, operating, maintaining, and improving our Services
• Creating and managing your account
• Processing transactions and payments
• Providing customer support and responding to inquiries
• Fulfilling orders and requests

• Communicating with you about our Services, including updates, security alerts, and administrative messages
• Sending you marketing communications about our products, services, offers, and promotions (subject to your communication preferences and applicable law)
• Conducting surveys and collecting feedback
• Providing personalized content and recommendations

• Analyzing usage trends and user behavior to improve our Services
• Conducting research and development
• Performing data analytics and business intelligence activities
• Managing our business operations and relationships

• Protecting the security and integrity of our Services and systems
• Detecting, preventing, and investigating fraud, security incidents, and other misuse
• Complying with legal obligations and regulatory requirements
• Enforcing our terms of service and other agreements
• Protecting our rights, property, and safety, and that of our users and others

• Providing targeted and interest-based advertising and marketing
• Measuring advertising effectiveness and performance
• Creating audience segments for marketing purposes

• Any other purpose disclosed to you at the time of collection
• Any other purpose for which you provide consent
• Any other purpose as permitted or required by applicable law

We may use automated tools and algorithms in connection with the Services, including for fraud detection, security monitoring, content personalization, and service optimization. We do not currently use automated decision-making technology to make decisions that produce legal or similarly significant effects concerning consumers without meaningful human involvement. If our practices change, we will update this Policy and provide any notices or rights required by applicable law, including opt-out and access rights under the California Consumer Privacy Act regulations and other state privacy laws that address profiling and automated decision-making.

We may share personal information with third-party service providers, contractors, and vendors who perform services for us or on our behalf, such as:

• Cloud computing and data storage providers
• Payment processors and financial institutions
• Customer support and help desk providers
• Marketing and advertising service providers
• Analytics and research providers
• IT and security service providers
• Professional service providers (such as legal, accounting, and audit firms)

These service providers are contractually obligated to protect your personal information and may only use it to provide services to us.

We may share personal information with our business partners, including providers and licensors of third-party software that we offer through our Services, where necessary for them to provide their services in connection with our Services. These partners are subject to contractual obligations regarding the handling of your personal information and are governed by their own privacy policies.

We may share personal information with advertising networks, marketing partners, and other third parties for advertising and marketing purposes, including to provide you with targeted advertisements. We do not currently sell or share personal information for cross-context behavioral advertising as those terms are defined under applicable state privacy laws. If our practices change, you may have rights to opt out of such activities as described in Section 6.

We may share personal information with our corporate affiliates and subsidiaries for business and operational purposes.

We may disclose or transfer personal information in connection with any actual or potential merger, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding.

We may disclose personal information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request
• Enforce our Terms of Use and other agreements, including investigation of potential violations
• Detect, prevent, or otherwise address fraud, security, or technical issues
• Protect the rights, property, or safety of Company, our users, or others, as required or permitted by law

We may disclose personal information for any other purpose with your consent or at your direction.

Information that you post or share in public areas of our Services (such as forums, comments, or user profiles set to public) may be viewed by other users and the general public.

• Cookies — small data files stored on your device that help us recognize you and remember your preferences
• Web beacons/pixels — small electronic files that allow us to count users who have visited pages and measure website usage

We use these technologies for various purposes, including:

• Essential functions (such as security, network management, and accessibility)
• Performance and analytics (such as understanding how our Services are used)
• Functionality (such as remembering your preferences and settings)
• Advertising and marketing (such as delivering targeted advertisements)

We use Google Analytics and other third-party analytics services to collect and analyze usage information. These services may use cookies and other technologies to collect information about your use of our Services and other websites. You can learn more about Google Analytics and opt out by visiting tools.google.com/dlpage/gaoptout.

We may partner with advertising networks and other third parties to display advertising on our Services or to manage and serve advertising on other sites. These partners may use cookies and other technologies to collect information about your activities across different websites and applications to provide you with advertising based on your interests.

You may manage your cookie preferences through our cookie preference center available on our websites, where you can accept or decline non-essential cookies. Most web browsers also accept cookies by default, but you can usually modify your browser settings to decline cookies if you prefer. Please note that disabling cookies may affect the functionality of our Services.

Our Services currently respond to Global Privacy Control (GPC) signals and other legally recognized universal opt-out mechanisms as required by applicable state law, including for residents of California, Colorado, Connecticut, Montana, and Texas. We may not respond to other "do not track" signals or similar mechanisms, but this may change as standards develop.

This website is hosted on Lovable, and Lovable collects website analytics for us. This analytics uses no cookies and stores nothing on your device. It does not keep your IP address, cannot identify who you are, and cannot recognize you as a returning visitor. Lovable's privacy policy at lovable.dev/privacy explains how it handles this data.

It records:

• The pages you visit and where you came from
• Your country, browser, operating system and device type
• How long you stay, how fast pages load, and errors
• Which buttons and links you click

Detailed data is kept for 90 days. Daily summaries — visit and page-view counts, and for each visit the pages seen and where the visitor came from — are kept for a year.

This site does not show a cookie consent banner, so this analytics runs for every visitor.

If you are a California resident, you have the following rights:

a. Right to Know

You may request that we disclose:

• The categories and specific pieces of personal information we have collected about you
• The categories of sources from which we collected your personal information
• The business or commercial purpose for collecting or selling your personal information
• The categories of third parties with whom we share your personal information
• The categories of personal information we have sold or shared and the categories of third parties to whom we sold or shared it

b. Right to Delete

You may request that we delete personal information we have collected from you, subject to certain exceptions.

c. Right to Correct

You may request that we correct inaccurate personal information we maintain about you.

d. Right to Opt-Out of Sale/Sharing

You may opt out of the sale or sharing of your personal information for cross-context behavioral advertising.

e. Right to Limit Use of Sensitive Personal Information

You may request that we limit our use of your sensitive personal information to certain purposes.

f. Non-Discrimination

We will not discriminate or retaliate against you for exercising any of these rights, including if you are an applicant, employee, or independent contractor, though we may charge different prices or provide different levels of service if the difference is reasonably related to the value of your personal information.

Financial Incentives

We do not currently offer any financial incentive programs (such as loyalty programs, price or service differences, or other benefits) in exchange for the retention, sale, or sharing of your personal information. If we offer such programs in the future, we will provide the disclosures required by applicable law, including a description of the material terms of the program and how to opt in or withdraw.

For purposes of California law, in the preceding 12 months, we have collected the following categories of personal information: identifiers, commercial information, internet or other electronic network activity information, geolocation data, professional or employment information, and inferences. We may use these categories of information for the business and commercial purposes described in Section 3 and may disclose them to the categories of recipients described in Section 4.

We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

In the preceding 12 months, we have not sold or shared personal information as those terms are defined under California law.

You have the right to opt out of the sale or sharing of your personal information. To exercise this right, please email legal@ciphertextsolutions.com or submit a request using the contact information in Section 6.7. We also process opt-out preference signals, including Global Privacy Control (GPC), as described in Section 5.6.

You have the right to limit our use and disclosure of your sensitive personal information to purposes that are necessary to provide the Services or as otherwise permitted by law. To exercise this right, please email legal@ciphertextsolutions.com or submit a request using the contact information in Section 6.7.

In the preceding 12 months, we have disclosed the following categories of personal information to service providers and contractors for the business purposes described in Section 3, including service provision and operations, communications, business operations and analytics, and security: identifiers, commercial information, internet or other electronic network activity information, geolocation data, and professional or employment information.

If you reside in a state with a comprehensive consumer privacy law, including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Minnesota, Maryland, and Rhode Island, you may have similar rights, including:

a. Right to Access

Request access to the personal information we have about you.

b. Right to Delete

Request deletion of your personal information, subject to exceptions.

c. Right to Correct

Request correction of inaccurate personal information.

d. Right to Data Portability

Request a copy of your personal information in a portable format.

e. Right to Opt Out

Opt out of targeted advertising, the sale of personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects.

f. Right to Appeal

If we decline your privacy request, you may appeal our decision through our internal appeal process.

Nevada Residents

Under Nevada Revised Statutes Chapter 603A, Nevada residents may submit a request directing us not to sell certain covered information that we have collected or will collect about them. To submit such a request, please contact us at legal@ciphertextsolutions.com with the subject line "Nevada Opt-Out Request."

To exercise any of these rights, please contact us at:

• Email: legal@ciphertextsolutions.com
• Mail: Ciphertext Solutions, Inc., PO Box 861, Saddle Brook, NJ 07663

We may require you to verify your identity before processing your request. We will respond to verified requests within 45 days (or as otherwise required by applicable law). If we need additional time, we will notify you of the extension and the reason for it.

We may decline requests that are manifestly unfounded, excessive, or repetitive, or that would compromise the privacy or security of others. We may also be unable to comply with requests where doing so would be inconsistent with legal obligations, regulatory requirements, ongoing litigation, or the exercise or defense of legal claims.

You may designate an authorized agent to make privacy requests on your behalf. We may require that you provide the authorized agent written permission and may require you to verify your identity directly with us before processing the request.

If you are located in the European Economic Area, United Kingdom, or Switzerland, the following additional information applies to you. Ciphertext Solutions, Inc. is the data controller responsible for processing your personal information as described in this Policy. We have not appointed a data protection officer or a representative in the European Union or United Kingdom at this time. For privacy inquiries, please contact us at legal@ciphertextsolutions.com.

We process your personal information on the following legal bases under applicable data protection law: (a) performance of a contract, where processing is necessary to provide our Services to you or to take steps at your request prior to entering into a contract, including the service provision and operations activities described in Section 3.1 and service-related communications described in Section 3.2; (b) legitimate interests, where processing is necessary for our legitimate business interests (such as fraud prevention, network and information security, analytics, and direct marketing), including the business operations and analytics activities described in Section 3.3, the security activities described in Section 3.4, and the advertising and marketing activities described in Section 3.5, provided those interests are not overridden by your data protection rights; (c) consent, where you have given consent to specific processing activities (such as marketing communications or non-essential cookies), which you may withdraw at any time; and (d) legal obligation, where processing is required to comply with applicable law, including the legal compliance activities described in Section 3.4.

In addition to the rights described elsewhere in this Policy, you may have the right to: (a) request restriction of processing of your personal information; (b) object to processing based on our legitimate interests, including direct marketing; (c) withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal; and (d) lodge a complaint with a data protection supervisory authority in your jurisdiction.

For questions about our processing of personal information under European data protection law, please contact us at legal@ciphertextsolutions.com.