Privacy Policy

1) Information We Collect

A. Personal information you provide

In short: We collect the information you give us.

• Account & Contact Data: name, email address, username.
• Academic Status (optional): student status for discount verification.
• Payment Data: handled by our processor. If you purchase a subscription, we collect the minimal details required to initiate payment; all payment data is Stripe.

Sensitive information: We do not request or process sensitive personal data (e.g., health, biometric, precise geolocation) unless required by law and with appropriate safeguards.

B. Information collected automatically

In short: Basic device information is collected when you use the Services.

• Log & Usage Data: IP address, device/browser type, settings, pages viewed, actions taken (e.g., uploads, searches, features used), access times, and URLs.
• Device & Data: device ID, OS, ISP or carrier, system configuration, approximate location (country/region).
• Cookies & Similar Technologies: cookies, pixels, local storage to keep you signed in, remember preferences, and analyze usage. See our Cookie Notice for control.

2) How We Process Your Information

In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our services, including:

• To facilitate account creation and authentication and accountwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to user. We may process your information to provide you with the requested service.
• To respond to user inquiries and offer user the best possible service. We may process your information to respond to your inquiries and solve your problems.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, or other similar information.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3) Legal Bases (GDPR/UK GDPR & Canada)

In short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to pursue our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or where we believe it is necessary to enter into a contract with you.
• Legal Obligations. We may process your information when we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

In legal terms, we are generally the "data controller" under European data protection laws of the personal information described in this privacy notice, since we determine the means and/or purposes of the data processing we perform. This privacy notice does not apply to the personal information we process as a data processor on behalf of our customers. In those situations, the customer that you provide services to and with whom we have entered into a data processing agreement is the "data controller" responsible for your personal information, and we merely process your information on their behalf in accordance with your instructions. If you want to know more about our customers' privacy practices, you should read their privacy policies and direct any questions to them.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time by accessing your account settings or contacting us at hello@cuflow.ai.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• For account security and fraud prevention
• To protect the integrity of our learning platform and prevent misuse
• To comply with legal obligations, court orders, or governmental requests
• To investigate violations of our Terms and Conditions
• To process and maintain records of your subscription payments
• To protect the safety of our community
• To maintain the technical functionality and security of our Services
• To analyze and improve our educational content processing systems
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court
• If the information is publicly available (such as our publicly available educational content)
• To protect the rights, property, or safety of our users, including:
• Preventing unauthorized access to learning spaces
• Preventing intellectual property rights
• Protecting the integrity of our educational content
• Ensuring proper functioning of the AI co-pilot and content analysis features

Your educational content and learning activities are processed only for the purposes outlined in our Terms and Conditions and this Privacy Policy.

4) When We Share Your Information

In short: We share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of or a portion of our business to another company.

5) Cookies & Tracking

In short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies like web beacons and pixels to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

6) Data Retention

In short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than three (3) months past the termination of the user's account.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will security step your personal information and isolate it from any further processing until deletion is possible.

7) Data Security

In short: We aim to protect your personal information through a system of organizational and technical security measures.

We implement technical and organizational measures (encryption in transit, access controls, least-privilege, monitoring). However, no internet transmission or storage system is 100% secure. Use the Services in a secure environment and notify us of any suspected breach.

8) Children's Privacy

In short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will delete the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at hello@cuflow.ai.

9) Your Privacy Rights

In short: In some regions, such as the European Economic Area (EEA), United Kingdom (UK), and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

Depending on your region (EEA/UK/Canada and others), you may have rights to:

• Access your data, correct inaccuracies, delete your data, restrict or object to processing, and data portability.
• Withdraw consent where processing is based on consent.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. Legal terms may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and reject cookies. If you choose to remove cookies or reject our cookies, this could affect certain features or services of our Services. You may also opt out of interest-based advertising by advertisers on our Services.

If you have questions or comments about your privacy rights, you may email us at hello@cuflow.ai.

10) Do-Not-Track

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored, used and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

11) California Privacy (CCPA/CPRA)

In short: If you are a resident of California, you are granted specific rights regarding access to your personal information.

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about all third parties with whom we shared personal information in the immediately preceding calendar year, and the names and addresses of all third parties with whom we shared personal information for marketing purposes in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with Services, you have the right to request removal of unvetted or inaccurate data you have posted in the Services. To request removal of such data, please contact us using the contact information provided below and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).

CCPA Privacy Notice

The California Code of Regulations defines a "resident" as:

1. (1) every individual who is in the State of California for other than a temporary or transitory purpose
2. (2) every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose

All other individuals are defined as "non-residents."

If this definition of "resident" applies to you, we must adhere to certain rights and obligations regarding your personal information.

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

Category Examples Collected A. Identifiers Contact details, such as real name, username, email address, unique personal identifier, online identifier, Internet Protocol address, and account name YES. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) NO. Commercial information Submission information, purchase history, payment information Al co-pilot interactions, learning space activities, content interaction NO. Internet or other similar network activity Platform usage data, Al co-pilot interactions, learning space activities, and vicarious NO. Internet or other similar network activity YES. Geolocation data devotional location NO. Audio, electronic, visual, thermal, olfactory, or similar information lecture recordings, video content processing, and educational content NO. Professional or employment-related information Business contact details in order to provide our Services at a business level NO. Educational information Learning materials, study patterns, content uploads, flashcards, and summaries YES. Internet or other similar network activity Al-generated learning recommendations, study patterns analysis, and content preferences YES. Sensitive personal information None NO

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A - As long as the user has an account with us
• Category B - As long as the user has an account with us
• Category D - As long as the user has an account with us
• Category G - As long as the user has an account with us
• Category H - As long as the user has an account with us
• Category J - As long as the user has an account with us
• Category K - As long as the user has an account with us

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels
• Using our Al co-pilot and learning features
• Managing your learning spaces and content
• Processing educational materials and lecture content
• Facilitating the delivery of our Services and responding to your inquiries

How do we use and share your personal information?

More information about your data collection and sharing practices can be found in this privacy notice.

You may contact us by email at hello@cuflow.ai or by referring to the contact details at the bottom of this document.

If you are using an authorized agent to exercise your right to opt out we may deny a request if the authorized agent does not submit proof that they have been validly authorized to act on your behalf.

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Each service provider is a for-profit entity that processes the information on our behalf, following the same strict privacy protection obligations mandated by the CCPA.

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

CuFlow has not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. CuFlow will not sell or share personal information in the future belonging to website visitors, users, and other consumers.

Your rights with respect to your data

Right to request deletion of the data — Request to delete

You can ask for the deletion of your personal information. If you ask us to delete your personal information, we will respect your request and delete your personal information, subject to certain exceptions provided by law, such as if we are not obligated to delete by law and consumer of his or her right to free speech, our compliance requirements resulting from a legal obligation, or the exercising another may be required to protect against legal activities.

Right to be informed — Request to know

Depending on the circumstances, you have a right to know:

• Whether we collect and use your personal information;
• the purposes for which personal information that we collect is used;
• the categories of personal information that we collect;
• the categories of personal information that we collect, shared, or disclosed for a business purpose;
• the categories of sources from which the personal information was collected;
• the categories of third parties with whom we share personal information for a business purpose;
• the specific pieces of personal information we collected about you;

In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to re-identify individual data to verify a consumer request.

Right to non-discrimination for the Exercise of Consumers' Privacy rights

We will not discriminate against you for exercising any of your privacy rights.

Right to limit use and disclosure of Sensitive Personal Information

We do not process consumers' sensitive personal information.

Information on your request. We will not deny your request to verify your identity. We will match the information you have provided us. The verification efforts we use to ask you to provide the same so that we can match it with the information you have previously provided us. For instance, depending on the type of request you have filed, we may ask you to provide certain information commonly used to match, such as your name, vida the information we already have on file, or we may contact you through a communication match (i.e., phone or email) that you have previously provided to us. We may also use other verification methods as the situation requires.

We will use personal information provided in your request to verify your identity or authority to make the request. To the extent we reasonably use any information addedly, we will not treat it for any purpose other than for verifying your identity and/or authority to make the request, unless we obtain another authorization from you.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent we reasonably use any information addedly, we will not treat it for any purpose other than for verifying your identity and/or authority to make the request, unless we obtain another authorization from you.

Other privacy rights

• You may object to the processing of your personal information
• You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information
• You can choose an authorized agent to make a request under the CCPA on your behalf. We may deny a request from the authorized agent that does not submit proof that they have been validly authorized to act on your behalf.
• You may request to opt out of future selling or sharing of your personal information to third parties. Upon receiving an opt-out request, we will act upon the request as soon as reasonably possible, but no later than 15 days from the date of the request.

To exercise these rights, you can contact us by email at hello@cuflow.ai or by referring to the contact details at the bottom of this document.

12) Virginia Privacy (VCDPA)

Virginia residents have the right to access, correct, delete, or obtain a copy of their personal information, and to opt out of targeted advertising, sale, or certain profiling. CuFlow Virginia residents have a right to exercise these rights. You can contact the Virginia Attorney General to submit a complaint.

13) Changes to This Policy

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible on our website. We will also notify you of any material changes to this privacy notice by email to you account's primary email address, if and where possible. You are advised to review this privacy notice periodically for any changes. Changes to this privacy notice are effective when they are posted on this page.

14) Contact Us

If you have questions or comments about this notice, or if you need to contact us about your data privacy rights, you can reach us at:

CuFlow [Inc./Ltd.]
Email: hello@cuflow.ai
Website: https://www.cuflow.ai

For privacy-related requests, including:

• Accessing your personal information
• Requesting data deletion
• Updating your preferences
• Privacy concerns
• Student requests (all other)

We aim to respond to privacy-related inquiries within 5-7 business days.

For general support inquiries, subscription management, or technical assistance, you can also contact us through your account settings or our support portal at https://www.cuflow.ai.

15) Review, Update, or Delete Your Data

You may request to review, update, or delete the personal information we hold about you by emailing hello@cuflow.ai or using your account settings.