ALETHRA™ PRIVACY POLICY

1. Overview and Scope

Alethra Inc., a Delaware corporation (“ALETHRA,” “we,” “our,” or “us”), is committed to protecting the privacy of personally identifiable information (“Personal Information,” “PII,” or “Personal Data”) collected about you and other visitors and users (collectively, “Users”) through our platform, digital interfaces, websites, artificial intelligence (“AI”) agents (including ALETHA), mobile applications, and any other services made available by ALETHRA (collectively, the “Services”).

This Privacy Policy (“Policy”) discloses our practices regarding the collection, use, storage, sharing, disclosure, and protection of the Personal Information we receive through your use of the Services, in accordance with applicable global data protection laws.

This Policy is drafted to comply with global data protection laws; however, the application of these laws depends on each individual case and your jurisdiction. Unless otherwise expressly agreed to in writing, your Personal Information will be processed according to the terms of this Policy. By accessing or using the Services, you accept the terms of this Policy. If you do not agree, you must not use the Services. Defined terms used but not defined herein have the meaning set forth in the Terms of Use as found at https://alethra.com/terms.

Users of the Services are under no statutory or contractual obligation to provide PII to us. For purposes of compliance with the General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection, ALETHRA is the data controller of information we collect from data subjects through the Services. For the purposes of this Policy, “data subject” means an identified or identifiable natural person.

This version of the Policy replaces and supersedes any prior privacy policies applicable to the Services.

2. Information We Collect

The information that we collect depends on your interactions with us, the choices that you make, the products and features you use, your location, and applicable laws. We may collect or receive information directly from you, such as your name and email address when you or your organization sign up for our Services or marketing activities.

In other cases, we receive information through your use of our Services, such as IP addresses and telemetry data. We are the sole owner of information collected through the Services, subject to the disclosures herein.

We collect several types of information from and about Users, including the following:

A. Personal Information Provided by You

We may collect PII (i.e., “personal data” under the GDPR) when you complete forms, create an account, participate in surveys, interact with ALETHA, navigate web pages, participate in beta testing, provide feedback, and in connection with other activities, services, features, or resources we make available through the Services.

PII means any information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.

PII does not include publicly available information from government records, deidentified or aggregate information, or information excluded from the scope of the GDPR or California Consumer Privacy Act (“CCPA”).

The types of PII we may collect include the following categories:

B. Information Collected Automatically

We may collect PII and deidentified information that your browser or device transmits when you visit or use the Services. We may also collect deidentified information about how you access and interact with the Services through the use of automated tracking technologies, such as session cookies, persistent cookies, and web beacons.

Automatically collected data may include:

• IP address, browser type and version, and operating system;
• Device identifiers, hardware identifiers, and device type;
• Visit duration, referring website, pages viewed, clickstream data, and usage patterns;
• Date and time stamps, approximate geographic location, and session telemetry;
• Internet service provider information; and
• Other technical and usage data.

C. AI Interaction Data

When you interact with ALETHA, our AI agent, certain information may be collected, including prompts, conversation data, contextual feedback, and interaction logs.

This data is used to improve AI accuracy and functionality, maintain user safety and content standards, and prevent misuse or illegal activity. All AI interactions are encrypted, monitored for compliance, and anonymized before analysis.

D. Sensitive or Special Category Data

We do not intentionally collect sensitive data (e.g., health, biometric, or financial details) unless explicitly required for research, beta participation, or compliance purposes and with your informed consent. Where we do collect such information, it is handled in accordance with applicable law.

E. Aggregated and Deidentified Data

We may collect, use, and disclose aggregated and deidentified data such as statistical or demographic data for any purpose. Aggregated and deidentified data could be derived from your Personal Information but is not considered Personal Information under applicable law as this data will not directly or indirectly reveal your identity.

your identity. However, if we combine or connect aggregated or deidentified data with your Personal Information so that it can directly or indirectly identify you, we treat the combined data as Personal Information which will be used in accordance with this Policy.

F. Information from Third-Party Services

We may collect PII about you from third parties whose privacy practices may differ from the practices described in this Policy. We do not make any representations or warranties concerning, and will not in any way be liable for, any informational content, products, services, software, or other materials available through third parties. Your use of third-party services and/or third-party websites is governed by and subject to the terms and conditions of those third parties. We encourage you to carefully review the privacy policies and statements of such third parties.

3. How We Collect Information

We collect information through the following methods:

Directly from You. We collect PII when you voluntarily submit it while using the Services, including during account registration, beta program participation, support requests, surveys, feedback submissions, newsletter subscriptions, and communications with ALETHA.

Through Your Use of the Services. We may collect PII and deidentified information that your browser or device transmits when you use the Services. We also collect information about how you access and interact with the Services through automated tracking technologies (see Section 11 below for more details on cookies and tracking technologies).

From Third-Party Services. We may receive PII about you from third parties, including analytics providers, cloud hosting providers, service providers, and other business partners, as described in Section 2(F) above.

4. How We Use Your Information

We use your data for the following lawful business purposes: (i) as necessary for the performance of our contract with you, (ii) for our legitimate interests, so long as they are not overridden by your own rights and interests, or (iii) as required by law.

Specifically, we use your information for:

• Service Delivery: Providing, operating, maintaining, and improving ALETHRA’s Services, including ALETHA and related AI functions.
• Personalization: Personalizing your user experience and platform performance, including displaying your name, preferences, and content tailored to your interests.
• Research and Development: Conducting research, development, model training, debugging, and audits to enhance our technology and Services.
• Security and Compliance: Maintaining security, compliance, and fraud prevention; enforcing our Terms of Use; protecting our rights, privacy, safety, or property; and detecting security incidents.
• Communications: Communicating updates, legal notices, service changes, promotional materials, and responding to your inquiries, questions, and support needs.
• Legal Obligations: Fulfilling legal and contractual obligations, including compliance with applicable laws and regulations.
• Account Administration: Creating and managing your account, including sending service announcements, updates, security alerts, and support messages.

No automated decision-making is used that produces legal or similarly significant effects on you without human oversight.

5. Data Use for AI Development

Anonymized interaction data may be used to train or refine AI systems, including ALETHA™, under strict ethical and regulatory frameworks. No personal identifiers or private information are shared externally for this purpose.

We do not use your data in a way that personally identifies you for AI model improvement. ALETHRA does not sell or share your information for advertising purposes.

6. Legal Basis for Processing

Our legal basis for collecting and using the Personal Information described in this Policy depends on the Personal Information we collect and the specific context in which we collect it. Processing is based on one or more of the following, as applicable:

• Consent: Where you have given clear consent for us to process your Personal Data for a specific purpose.
• Performance of a Contract: Where the processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract.
• Legal Obligation: Where the processing is necessary for compliance with a legal obligation to which ALETHRA is subject.
• Legitimate Interests: Where the processing is necessary for the legitimate interests pursued by ALETHRA or a third party, except where such interests are overridden by your rights and interests.

7. Data Sharing and Disclosure

We may share data only when necessary with the following categories of recipients:

• Subsidiaries and Affiliates: Subsidiaries, affiliates, or related entities of ALETHRA.
• Service Providers: Service providers and contractors that support ALETHRA’s operations, including website hosting, software development, payment processing, analytics, security, customer service, email delivery, and auditing (“Service Providers”). Service Providers are bound by contractual obligations to keep Personal Information confidential and use it only for the purposes for which we disclose it to them.
• Legal and Regulatory Authorities: Legal, regulatory, or governmental authorities when required by law, court order, subpoena, or warrant, or when we believe disclosure is necessary to comply with any applicable law or regulation, to protect and defend our rights or property, to prevent or investigate possible wrongdoing, to protect the personal safety of Users or the public, or to protect against legal liability.
• Strategic Partners: Strategic partners under confidentiality and data-processing agreements.
• Business Transfers: In the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of ALETHRA’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by ALETHRA is among the assets transferred. In such circumstances, ALETHRA will ensure your information is used in accordance with this Policy.
• Aggregate and Deidentified Information: We may use, disclose, and otherwise process aggregate and deidentified information related to our business and the Services for quality control, analytics, research, development, and other purposes. Such use shall not include Personal Information or information that can identify you as an individual or reasonably be used to identify you.

Except as described in this Policy, we will not share your information with third parties without your notice and consent. We do not sell or share your Personal Information for advertising purposes.

8. International Data Transfers

Data may be transferred internationally, including to the United States, subject to appropriate safeguards. In the event we transfer PII outside the European Economic Area (“EEA”), the United Kingdom, or Switzerland, we will do so in accordance with the terms of this Policy and applicable data protection law.

Our standard practice is to use Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner’s Office, and/or adjusted according to Swiss law as applicable and required, to facilitate such data transfers.

Where required under applicable law, we will ensure that appropriate contractual or other safeguards are in place to protect your Personal Information during any such transfer.

9. Data Retention

Personal Data is retained only as long as reasonably necessary to fulfill the purposes described herein, unless a longer retention period is required by law, consented to by you, or necessary to resolve disputes, enforce our agreements, or for safety, security, and fraud prevention.

At the end of the retention period, Personal Data will be deleted, destroyed, or deidentified. In some circumstances, we may anonymize your Personal Data (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you.

10. Data Security

We implement physical, technical, and organizational safeguards designed to protect your Personal Information against accidental loss and from unauthorized access, use, alteration, and disclosure. These measures include encryption, access controls, audit trails, and other industry-standard protections.

However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the absolute security of your Personal Data. Any transmission of Personal Data is at your own risk.

The safety and security of your information also depends on you. You are responsible for maintaining the confidentiality of any login credentials or passwords associated with your account and for taking steps to protect your Personal Data against unauthorized use, disclosure, and access.

If you believe your credentials have been compromised, please change your password and notify us immediately at privacy@alethra.com.

11. Cookies and Tracking Technologies

ALETHRA uses cookies and similar technologies to enhance your experience on our Services. Specifically, we use cookies and related technologies to:

• Essential Cookies: Keep you logged in and ensure the functionality of the Services. These cookies are required for the operation of the Services and cannot be disabled.
• Performance/Analytical Cookies: Measure usage, monitor and analyze Services traffic and usage patterns, and improve the Services. These cookies collect anonymous information on how you use the Services.
• Functional Cookies: Remember your preferences and provide enhanced functionality, such as remembering your settings and choices.

You can adjust cookie settings through your browser. Most browsers allow you to refuse all or some browser cookies or to alert you when cookies are being sent. However, disabling cookies may limit certain features of the Services.

For more information about cookies and how to manage them, visit your browser’s help section or https://www.allaboutcookies.org. Some parts of the Services and our emails may contain small electronic files known as web beacons (also referred to as clear GIFs, pixel tags, and single-pixel GIFs) that permit ALETHRA, for example, to count users who have visited certain pages or opened an email and for other related analytics.

12. Do Not Track Disclosure

Some internet browsers may transmit “Do Not Track” signals to websites with which the browser communicates. The Services do not currently respond to “Do Not Track” signals. You can disable cookies or use other privacy tools to manage your tracking preferences.

California, Colorado, Connecticut, and residents of other applicable U.S. states can opt out by broadcasting an Opt-Out Preference Signal, including through the use of the Global Privacy Control (“GPC”), depending on which browsers and/or browser extensions you use that may support such signals.

To learn more about GPC, please visit https://globalprivacycontrol.org/. When we detect such a signal, we will make reasonable efforts to respect your choices as required by applicable law.

13. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your Personal Information. We will not discriminate against you for exercising your privacy rights.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights in relation to our processing of your Personal Information:

• Right to Access: You have the right to request a copy of your Personal Information that we hold.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete Personal Information.
• Right to Erasure (“Right to Be Forgotten”): You have the right to request that we delete your Personal Information, subject to certain exceptions.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your Personal Information.
• Right to Object: You have the right to object to our processing of your Personal Information.
• Right to Data Portability: You have the right to receive your Personal Information in a structured, machine-readable, and commonly used format.
• Right to Withdraw Consent: Where we rely on your consent to process your Personal Information, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent before its withdrawal.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

If you are a data subject located in the EEA, the GDPR grants you the right to lodge a complaint with a competent supervisory authority as well. To find a competent supervisory authority, please use the following resource: https://edpb.europa.eu/about-edpb/board/members_en. UK data subjects can use the following resource: https://ico.org.uk/global/contact-us/.

Under certain U.S. state laws, including the CCPA/CPRA and the privacy laws of Colorado, Connecticut, Virginia, Utah, and other states, residents may have the following rights, subject to applicable limitations, exemptions, or exceptions:

• Right to Know/Access: The right to confirm whether we process your Personal Information and to request the specific pieces of Personal Information we have collected about you, the categories of Personal Information collected, the sources from which it was collected, the business or commercial purposes for collecting it, and the categories of third parties to whom it was disclosed.
• Right to Delete: The right to request that we delete Personal Information we have collected about you, subject to certain exceptions under applicable law.
• Right to Correct: The right to request that we correct inaccurate Personal Information.
• Right to Opt-Out of Sale/Sharing: The right to opt out of the sale or sharing of your Personal Information for cross-context behavioral advertising. ALETHRA does not sell your Personal Information.
• Right to Limit Use of Sensitive Personal Information: The right to limit the use and disclosure of Sensitive Personal Information, as defined under the California Privacy Rights Act (“CPRA”).
• Right to Non-Discrimination: The right not to be discriminated against for exercising any of these rights.
• Right to Data Portability: The right to receive your Personal Information in a portable and readily usable format.

To exercise your rights, only you or an authorized agent acting on your behalf may make a request. To verify your identity, we may require you to provide sufficient information to allow us to identify you in our records. We will respond to your request within the applicable timeframe required under applicable law.

To exercise any of the above rights, please contact us at: privacy@alethra.com. To help us process your request, please provide sufficient information to allow us to identify you in our records.

We reserve the right to ask for additional information verifying your identity prior to disclosing any PII to you. Should we ask for verification, the information you provide will be used only for verification purposes, and all copies of the information will be destroyed when the process is complete.

We will make commercially reasonable efforts to respond to requests without unreasonable delay and in any event within one (1) month (or such other period as required by applicable law) of receipt of your request. Where circumstances require, we may extend the reply period for an additional two months.

14. Opt-Out Rights

You may opt out of the following at any time by emailing privacy@alethra.com:

• AI data collection for personalization;
• Receiving direct marketing or promotional communications (you may also opt out by following the instructions provided in each such communication).

Please be aware that although you may opt out of direct marketing communications, we reserve the right to send you administrative notices regarding the Services, as permitted under the CAN-SPAM Act and other applicable law.

15. Beta Participation Terms

Users participating in ALETHRA beta programs acknowledge that:

• Beta services may include untested or experimental features.
• Performance, stability, or AI outputs (including ALETHA interactions) may vary.
• Feedback provided during participation may be used for product improvement and AI training.
• Participation is voluntary and may be terminated at any time by you or by ALETHRA.
• All beta data is processed securely under the same privacy standards outlined in this Policy.

16. Children’s Privacy

The Services are not intended for, and are not directed toward, individuals under the age of 18 (or under the age of majority in the applicable user’s jurisdiction). ALETHRA does not knowingly collect Personal Information from minors under the age of 18.

If we learn we have collected or received Personal Data from a child under 18 years old without verification of parental consent, we will take commercially reasonable efforts to delete such information from our systems. If a parent or guardian becomes aware that their child has provided us with information without their consent, they should contact us at privacy@alethra.com.

17. Third-Party Links

The Services may contain links to other websites or applications (“Linked Sites”) that are not owned or operated by ALETHRA. We do not control the collection or use of any information, including PII, which occurs while you visit Linked Sites.

Therefore, we make no representations or warranties for, and will not in any way be liable for, any content, products, services, software, or other materials available on Linked Sites, even if one or more pages of the Linked Sites are framed within a page of the Services.

Furthermore, we make no representations or warranties about the privacy policies or practices of the Linked Sites, and ALETHRA is not responsible for the privacy practices of those Linked Sites. We encourage you to be aware of when you leave the Services and to read the privacy policies of any Linked Site you visit.

18. SPAM

We do not participate in bulk email solicitations that you have not consented to receiving. We do not sell or disclose customer lists or email address lists to unrelated third parties.

Except as otherwise provided herein, we do not share PII with any third-party advertisers.

19. Modifications and Updates

ALETHRA reserves the right to update this Policy from time to time in its sole discretion. If our privacy practices change materially in the future, we will post an updated version of the Policy on our official sites and revise the “Last Updated” date at the top of this Policy.

Any modifications to this Policy will be effective upon our posting of the updated terms. We will not lessen your rights under this Policy without your explicit consent.

It is your responsibility to review this Policy for any changes each time you use the Services. Your continued use of the Services after we make changes is deemed to be acceptance of those changes.

20. Accessing, Updating, and Controlling Your Information

If you ever wish to access, update, change, delete, opt out of us sharing, or otherwise control your PII, or remove or alter your account, you may do so by contacting us at the Contact Information provided below.

You may also delete your account at any time. We reserve the right to ask for additional information verifying your identity prior to disclosing any PII to you.

21. File a Complaint

If you would like to file a complaint with us about our privacy practices, please contact us at the Contact Information provided below.

If you are a data subject located in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with a competent supervisory authority, as described in Section 13 above.

22. Contact Information

If you have questions about this Policy, wish to exercise any of your rights, or wish to contact us with questions, comments, or complaints, please contact us at:

privacy@alethra.com