PRIVACY POLICY

FilingFlow.app

Effective Date: November 21, 2025
Last Updated: November 21, 2025

---

1. INTRODUCTION

Welcome to FilingFlow.app ("FilingFlow," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you access or use our website, mobile applications, and services (collectively, the "Service").

Your privacy is important to us. We are committed to transparency about our data practices and providing you with meaningful control over your personal information.

This Privacy Policy is incorporated into and is part of our Terms of Service. By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1.1 Key Points Summary

• What We Collect: Account information, usage data, SEC filing preferences, payment details
• How We Use It: To provide the Service, send notifications, process payments, improve our platform
• Who We Share With: Service providers (payment processors, hosting), law enforcement when required
• Your Rights: Access, delete, correct your data; opt-out of marketing; data portability
• Data Security: Industry-standard encryption, access controls, regular security audits
• Contact: [email protected] for questions or to exercise your rights

1.2 Scope and Applicability

This Privacy Policy applies to:

• All users of FilingFlow.app website and mobile applications
• Visitors to our website, whether registered or not
• All personal information collected through the Service

This Privacy Policy does NOT apply to:

• Third-party websites or services linked from our Service
• Information collected offline or through other channels
• Employment or B2B commercial relationship data (covered by separate policies)

---

2. INFORMATION WE COLLECT

We collect information that you provide directly, information collected automatically through your use of the Service, and information from third-party sources.

2.1 Information You Provide Directly

Account Registration Information:

When you create an account, we collect:

• Full name (first and last)
• Email address
• Password (stored in encrypted form)
• Company/organization name (optional)
• Job title or role (optional)
• Phone number (optional)

Payment Information:

When you subscribe to a paid plan:

• Credit card number, expiration date, CVV (processed securely by our payment processor)
• Billing address (street address, city, state, ZIP code, country)
• Billing contact name and email

Note: We do NOT store complete credit card numbers on our servers. Payment information is processed and stored by our PCI-DSS compliant payment processor (Stripe).

Profile and Preference Information:

• SEC filing types you wish to monitor (e.g., Form D, 10-K, 8-K)
• Companies and competitors you track
• Alert preferences and notification settings
• Time zone and language preferences
• Custom search filters and saved queries

Communications with Us:

• Support requests and customer service correspondence
• Feedback, survey responses, and testimonials
• Messages sent through contact forms or chat features

User-Generated Content:

• Notes or annotations you add to filings
• Custom tags or labels
• Shared reports or exports (if applicable)

2.2 Information Collected Automatically

Usage and Log Data:

When you access the Service, we automatically collect:

• IP address and approximate geographic location (city/region level)
• Browser type, version, and language settings
• Operating system and device type (desktop, mobile, tablet)
• Referring and exit pages and URLs
• Date and time stamps of access
• Pages viewed, features used, and actions taken
• Time spent on pages and session duration
• Search queries entered within the Service

Cookies and Similar Technologies:

We use cookies, web beacons, and similar tracking technologies to:

• Maintain your login session
• Remember your preferences and settings
• Analyze usage patterns and improve the Service
• Provide personalized content and recommendations
• Measure the effectiveness of marketing campaigns

Types of cookies we use:

1. Essential Cookies: Required for the Service to function (e.g., session management, security)
2. Analytics Cookies: Help us understand how users interact with the Service (e.g., Google Analytics)
3. Preference Cookies: Remember your settings and choices
4. Marketing Cookies: Track your activity for targeted advertising (with your consent)

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of the Service.

Mobile Device Information:

If you access the Service through a mobile application:

• Device identifier (UDID, advertising ID)
• Mobile carrier
• Device model and manufacturer
• Mobile operating system version
• Push notification tokens (if you opt-in to notifications)

Analytics and Performance Data:

• Error logs and crash reports
• Performance metrics (page load times, API response times)
• Feature usage statistics

2.3 Information from Third-Party Sources

SEC EDGAR Database:

• Publicly available SEC filing data that you search for or monitor
• Company information from public filings

Note on contact information in SEC filings: Filings such as Form D often include an issuer's principal place of business and a contact telephone number, and that information is filed with the SEC and published by the SEC on EDGAR. We republish it as it appears in the filing. Issuer names, offering details, fund names, and city/state locations remain part of the record; street addresses and telephone numbers can be suppressed from our Service on request. See Section 17 for how to make that request. The underlying filings remain available from the SEC and from other republishers regardless of what we suppress.

Payment Processor:

• Transaction confirmation and payment status
• Fraud detection signals

Marketing and Lead Generation:

• Professional contact information from business directories (for B2B outreach)
• Email engagement data from marketing platforms

Social Media (if you choose to connect):

• Profile information from LinkedIn, Twitter, or other platforms if you use social login features

---

3. HOW WE USE YOUR INFORMATION

We use your personal information for the following purposes:

3.1 Provide and Improve the Service

• Account Management: Create and manage your account, authenticate your identity, maintain your subscription
• Service Delivery: Provide access to SEC filing data, deliver alerts and notifications, enable search and filtering functionality
• Customization: Personalize your experience based on your preferences and usage patterns
• Technical Support: Respond to support requests, troubleshoot issues, provide customer service
• Product Development: Analyze usage data to improve features, develop new functionality, optimize performance
• Quality Assurance: Monitor Service quality, identify and fix bugs, conduct testing

3.2 Process Payments and Prevent Fraud

• Process subscription payments and manage billing
• Detect and prevent fraudulent transactions
• Verify payment information and billing addresses
• Issue invoices and receipts
• Handle refund requests and billing disputes

3.3 Communicate with You

• Transactional Communications: Send account confirmations, subscription renewals, payment receipts, service notifications
• Alert Notifications: Deliver SEC filing alerts based on your monitoring preferences
• Product Updates: Inform you about new features, improvements, and changes to the Service
• Marketing Communications: Send newsletters, promotional offers, and product announcements (with your consent)
• Surveys and Feedback: Request feedback to improve our Service

You can opt-out of marketing communications at any time using the unsubscribe link in emails or by adjusting your account settings.

3.4 Ensure Security and Compliance

• Protect against unauthorized access, misuse, or security threats
• Detect and investigate suspicious activity or potential violations of our Terms of Service
• Enforce our legal rights and comply with our policies
• Respond to legal requests from law enforcement or regulatory authorities
• Comply with applicable laws, regulations, and industry standards

3.5 Analytics and Business Intelligence

• Analyze aggregate usage trends and demographics
• Generate reports on Service performance and user behavior
• Conduct market research and competitive analysis
• Measure the effectiveness of marketing campaigns
• Support strategic business decisions

3.6 Legal Compliance

• Comply with legal obligations, including tax reporting and record-keeping requirements
• Respond to subpoenas, court orders, and legal process
• Establish, exercise, or defend legal claims
• Protect the rights, property, or safety of FilingFlow, our users, or others

---

4. HOW WE SHARE YOUR INFORMATION

We do NOT sell your personal information to third parties for monetary consideration. We share your information only in the following limited circumstances:

4.1 Service Providers and Business Partners

We share information with third-party vendors who perform services on our behalf:

Payment Processing:

• Stripe - Payment processing and billing management
• Purpose: Process credit card transactions, manage subscriptions, handle refunds

Cloud Infrastructure:

• Amazon Web Services (AWS) - Cloud hosting and data storage
• Purpose: Host our application, store data, provide computing resources

Analytics and Monitoring:

• Google Analytics - Website and application analytics
• Sentry - Error tracking and performance monitoring
• Purpose: Analyze usage patterns, identify technical issues, improve Service performance

Communication Services:

• SendGrid or Mailgun - Transactional and marketing email delivery
• Twilio (if applicable) - SMS notifications
• Purpose: Deliver alerts, notifications, and communications

Customer Support:

• Intercom or Zendesk (if applicable) - Customer support platform
• Purpose: Manage support tickets, provide live chat assistance

All service providers are contractually obligated to:

• Use your information only for the purposes we specify
• Implement appropriate security measures
• Comply with applicable data protection laws
• Delete or return information when services are terminated

4.2 Legal Compliance and Protection

We may disclose your information when required or permitted by law:

• Legal Obligations: Comply with subpoenas, court orders, or legal process
• Law Enforcement: Cooperate with government investigations or regulatory inquiries
• Rights Protection: Enforce our Terms of Service, investigate violations, protect against fraud
• Safety: Protect the safety, security, or integrity of the Service or prevent harm to users or others
• Regulatory Reporting: Comply with financial, tax, or securities regulations

4.3 Business Transfers

In the event of a merger, acquisition, bankruptcy, reorganization, or sale of assets:

• Your information may be transferred to the successor entity
• We will provide notice before your information becomes subject to a different privacy policy
• You will have the opportunity to delete your account before the transfer

4.4 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you:

• Industry reports and market research
• Usage statistics and trends
• Benchmarking data
• Public presentations or publications

This information does not constitute "personal information" under privacy laws and is not subject to the restrictions in this Privacy Policy.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent, such as:

• Displaying testimonials on our website (with your name and company)
• Publishing case studies featuring your use of the Service
• Sharing information with partners for joint offerings or promotions

---

5. DATA RETENTION

5.1 Retention Periods

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Active Accounts:

• Information is retained throughout the duration of your active subscription
• Usage data and logs are typically retained for 12-24 months for analytics and troubleshooting

Cancelled or Expired Accounts:

• Account data is retained for 90 days after subscription termination to allow for reactivation
• After 90 days, most personal information is permanently deleted
• Certain information may be retained longer for legal, regulatory, or legitimate business purposes

Financial Records:

• Payment and billing records are retained for 7 years to comply with tax laws and financial regulations
• Transaction history may be retained for fraud prevention and dispute resolution

Communications and Support Records:

• Support tickets and correspondence are retained for 3 years for quality assurance and legal purposes

Legal Holds:

• Information subject to legal proceedings, investigations, or regulatory inquiries is retained until the matter is resolved

5.2 Data Deletion

User-Initiated Deletion:

You can request deletion of your account and personal information at any time by:

• Contacting [email protected]
• Using the account deletion feature in your account settings (if available)

Upon receiving a deletion request:

• We will delete or anonymize your personal information within 30 days
• Some information may be retained in backup systems for up to 90 days before permanent deletion
• Information required for legal, regulatory, or security purposes may be retained longer

Exceptions to Deletion:

We may retain certain information even after a deletion request:

• Transaction records for financial compliance (7 years)
• Information necessary to resolve disputes or enforce agreements
• De-identified or aggregated data that cannot be used to identify you
• Information required to comply with legal obligations

5.3 Backup and Archival Systems

• Deleted data may persist in backup systems for up to 90 days
• Backup systems are securely maintained and not actively accessed
• Data in backups is permanently deleted according to our backup retention schedule

---

6. DATA SECURITY

6.1 Security Measures

We implement industry-standard security measures to protect your personal information:

Technical Safeguards:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Encryption at Rest: Sensitive data stored on our servers is encrypted using AES-256 encryption
• Secure Authentication: Passwords are hashed using bcrypt with salt
• Access Controls: Role-based access controls limit employee access to personal information
• Firewall Protection: Network firewalls protect against unauthorized access
• Intrusion Detection: Automated systems monitor for suspicious activity

Administrative Safeguards:

• Employee Training: Regular privacy and security training for all employees
• Background Checks: Background screening for employees with access to personal information
• Confidentiality Agreements: All employees sign confidentiality and data protection agreements
• Access Review: Quarterly reviews of employee access privileges
• Incident Response Plan: Documented procedures for responding to data breaches

Physical Safeguards:

• Data Center Security: Our cloud infrastructure providers (AWS) maintain SOC 2 Type II certified data centers
• Physical Access Controls: Multi-factor authentication and biometric controls for data center access
• Environmental Controls: Fire suppression, climate control, and backup power systems

Third-Party Security:

• Vendor Assessments: Security reviews of all service providers handling personal information
• Contractual Protections: Data processing agreements requiring appropriate security measures
• Compliance Certifications: Preference for vendors with ISO 27001, SOC 2, or equivalent certifications

6.2 Limitations of Security

No method of transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. You acknowledge and accept the inherent risks of transmitting information over the internet.

Your Responsibilities:

• Choose a strong, unique password and keep it confidential
• Do not share your account credentials with others
• Enable two-factor authentication if offered
• Log out of your account when using shared or public devices
• Promptly notify us of any unauthorized access or security concerns

6.3 Data Breach Notification

In the event of a data breach that poses a risk to your personal information:

• We will investigate and assess the scope and impact within 72 hours of discovery
• Affected users will be notified via email within 72 hours of confirmation
• We will provide information about the nature of the breach, data affected, and steps being taken
• We will comply with all applicable data breach notification laws
• We will cooperate with regulatory authorities and law enforcement as required

---

7. YOUR PRIVACY RIGHTS

7.1 Rights Under California Law (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know:

• Request information about the categories and specific pieces of personal information we collected about you
• Request information about the categories of sources from which we collected your information
• Request information about the business purposes for collecting or selling your information
• Request information about the categories of third parties with whom we share your information

Right to Delete:

• Request deletion of your personal information, subject to certain exceptions

Right to Correct:

• Request correction of inaccurate personal information we maintain about you

Right to Opt-Out:

• Opt-out of the "sale" or "sharing" of your personal information (Note: We do NOT sell personal information)

Right to Limit Use of Sensitive Personal Information:

• Limit our use of sensitive personal information (financial data, precise geolocation, passwords) to purposes necessary to provide the Service

Right to Non-Discrimination:

• You will not be discriminated against for exercising your privacy rights
• We will not deny Service, charge different prices, or provide different quality of service

Right to Data Portability:

• Request a copy of your personal information in a portable format

Authorized Agent:

• You may designate an authorized agent to submit requests on your behalf (must provide written authorization)

7.2 Rights Under Other State Privacy Laws

If you reside in Virginia, Colorado, Connecticut, Utah, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Delaware, Oregon, Montana, or Texas, you have similar rights under your state's privacy law, including:

• Right to access your personal information
• Right to delete your personal information
• Right to correct inaccuracies
• Right to opt-out of targeted advertising
• Right to opt-out of profiling
• Right to data portability

7.3 Rights Under GDPR (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

Right of Access:

• Obtain confirmation of whether we process your personal data and request a copy

Right to Rectification:

• Request correction of inaccurate or incomplete personal data

Right to Erasure ("Right to be Forgotten"):

• Request deletion of your personal data in certain circumstances

Right to Restriction of Processing:

• Request that we limit how we use your personal data

Right to Data Portability:

• Receive your personal data in a structured, machine-readable format and transmit it to another controller

Right to Object:

• Object to processing based on legitimate interests or for direct marketing purposes

Right to Withdraw Consent:

• Withdraw consent at any time where processing is based on consent

Right to Lodge a Complaint:

• File a complaint with your local data protection authority (supervisory authority)

Legal Basis for Processing (GDPR):

We process your personal data based on the following legal grounds:

• Contract: To perform our contract with you (Terms of Service)
• Legitimate Interests: To improve the Service, prevent fraud, ensure security
• Consent: For marketing communications, non-essential cookies
• Legal Obligation: To comply with applicable laws and regulations

7.4 How to Exercise Your Rights

To exercise any of the above rights, please:

Email: [email protected]
Subject Line: Privacy Rights Request – [Specify: Access / Deletion / Correction / Opt-Out]

Include in your request:

• Your full name and email address associated with your account
• Specific right you wish to exercise
• Description of the information or action requested
• Any relevant account details to help us verify your identity

Verification Process:

To protect your privacy, we will verify your identity before processing your request:

• We may ask you to confirm information associated with your account
• For sensitive requests (deletion, access to detailed information), we may require additional verification
• Authorized agents must provide proof of authorization

Response Timeline:

• We will acknowledge receipt of your request within 5 business days
• We will respond to your request within 45 days (may be extended by 45 additional days if necessary)
• If we deny your request, we will explain the reason

No Fee:

• We do not charge a fee to process requests unless they are manifestly unfounded, excessive, or repetitive
• If a fee applies, we will notify you before processing the request

---

8. COOKIES AND TRACKING TECHNOLOGIES

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, authenticate your session, and track usage patterns.

8.2 Types of Cookies We Use

Essential Cookies (Always Active):

• Session management and authentication
• Security features and fraud prevention
• Load balancing and Service delivery

Analytics and Performance Cookies:

• Google Analytics (usage statistics, traffic sources, page views)
• Error tracking and performance monitoring
• A/B testing and feature optimization

Functionality Cookies:

• Remember your language and regional preferences
• Save your alert settings and custom filters
• Store your dashboard layout preferences

Marketing and Advertising Cookies (Requires Consent):

• Track effectiveness of marketing campaigns
• Provide personalized content recommendations
• Retargeting advertisements on third-party platforms (e.g., Google Ads, LinkedIn Ads)

8.3 Third-Party Cookies

Some cookies are set by third-party services integrated into our Service:

• Google Analytics - Web analytics
• Stripe - Payment processing
• Intercom - Customer support chat (if applicable)
• LinkedIn Insight Tag - Advertising and analytics (if applicable)

These third parties have their own privacy policies governing how they use information collected through cookies.

8.4 Cookie Management

Browser Settings:

You can control cookies through your browser settings:

• Chrome: Settings > Privacy and Security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Cookies and site permissions

Cookie Consent Tool:

When you first visit our website, you will see a cookie consent banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Customize your cookie preferences

You can change your cookie preferences at any time using the cookie settings link in the website footer.

Do Not Track (DNT):

Some browsers offer a "Do Not Track" signal. We currently do not respond to DNT signals because there is no industry standard for how to interpret and implement them.

Impact of Disabling Cookies:

Disabling cookies may affect your ability to:

• Stay logged into your account
• Use certain features of the Service
• Receive personalized content and recommendations

Essential cookies cannot be disabled as they are necessary for the Service to function.

---

9. INTERNATIONAL DATA TRANSFERS

9.1 Data Processing Locations

FilingFlow is based in the United States, and our servers and service providers are primarily located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.

The United States may have data protection laws that differ from those in your country.

9.2 Transfers from the EEA, UK, and Switzerland

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following mechanisms to lawfully transfer your personal data to the United States:

Standard Contractual Clauses (SCCs):

• We use European Commission-approved Standard Contractual Clauses with our service providers to ensure adequate protection

Adequacy Decisions:

• We rely on adequacy decisions where the European Commission has determined that certain countries provide adequate data protection

Consent:

• In some cases, we may obtain your explicit consent for specific data transfers

9.3 Data Protection Officer

For questions about international data transfers or GDPR compliance, you can contact our Data Protection Officer:

Email: [email protected]
Subject: Data Protection Inquiry

---

10. CHILDREN'S PRIVACY

10.1 Age Restriction

The Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18.

If you are under 18, do not:

• Use or access the Service
• Register for an account
• Provide any personal information through the Service

10.2 Parental Notice

If you are a parent or guardian and believe your child under 18 has provided personal information to FilingFlow:

• Contact us immediately at [email protected]
• We will promptly delete the information upon verification

10.3 Compliance with COPPA

We comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13.

---

11. MARKETING COMMUNICATIONS AND OPT-OUT

11.1 Types of Communications

Transactional Communications (Cannot Opt-Out):

These are necessary to provide the Service and you cannot opt-out:

• Account creation confirmations
• Subscription renewal notices
• Payment receipts and billing statements
• Security alerts and password reset emails
• Service announcements and critical updates
• SEC filing alerts based on your saved preferences

Marketing Communications (Can Opt-Out):

You can choose whether to receive:

• Promotional emails about new features and product updates
• Newsletter with industry insights and tips
• Special offers and discounts
• Event invitations and webinars
• Customer surveys and feedback requests

11.2 How to Opt-Out of Marketing

Unsubscribe Link:

• Every marketing email includes an "Unsubscribe" link at the bottom
• Click the link to opt-out of future marketing emails

Account Settings:

• Log into your account and navigate to Email Preferences
• Adjust your communication preferences for each type of email

Email Us:

• Send a request to [email protected] with subject "Unsubscribe from Marketing"

Processing Time:

• Opt-out requests are processed within 5 business days
• You may receive emails already in progress during this period

11.3 SMS/Text Messages

If you opt-in to receive SMS notifications:

• Reply STOP to any message to opt-out
• Reply HELP for assistance
• Standard message and data rates may apply

---

12. THIRD-PARTY LINKS AND SERVICES

12.1 External Websites

The Service may contain links to third-party websites, including:

• SEC.gov (official SEC EDGAR database)
• Company websites referenced in filings
• News articles and research sources
• Partner services and integrations

We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any external sites you visit.

12.2 Third-Party Integrations

If you choose to integrate third-party services with your FilingFlow account (e.g., Slack, Microsoft Teams, Zapier):

• You authorize us to share specific information with those services as necessary to provide the integration
• The third-party service's privacy policy will govern their use of your information
• You can disconnect integrations at any time through your account settings

12.3 Social Media Features

The Service may include social media features (e.g., "Share on LinkedIn" buttons). These features may:

• Collect your IP address and page visited
• Set cookies to enable functionality
• Be governed by the social media platform's privacy policy

---

13. CALIFORNIA PRIVACY DISCLOSURES

13.1 CCPA Information Collection Table

In the past 12 months, we have collected the following categories of personal information from California residents:

We do NOT collect: Sensitive personal information (racial/ethnic origin, religious beliefs, health information, sexual orientation, biometric identifiers for unique identification).

13.2 Sale and Sharing of Personal Information

We do NOT "sell" personal information as defined by CCPA. We do not exchange personal information for monetary consideration.

Sharing for Cross-Context Behavioral Advertising:

We may share certain identifiers and internet activity information with advertising partners for targeted advertising purposes:

• Google Ads (advertising platform)
• LinkedIn Ads (professional advertising)

This sharing may be considered a "sale" or "sharing" under CCPA. You have the right to opt-out of this activity.

To opt-out:

• Visit our website footer and click "Do Not Sell or Share My Personal Information"
• Adjust your cookie preferences to disable marketing cookies
• Email [email protected] with subject "Opt-Out of Sale/Sharing"

13.3 Retention and Deletion

Refer to Section 5 (Data Retention) for detailed information on how long we retain personal information and your right to request deletion.

13.4 Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights. You will receive the same level of service regardless of whether you exercise your rights.

13.5 Authorized Agents

California residents may designate an authorized agent to submit privacy requests on their behalf. The agent must:

• Provide written authorization signed by the consumer
• Verify their identity and authority
• Submit the request through [email protected]

---

14. CHANGES TO THIS PRIVACY POLICY

14.1 Notification of Changes

We may update this Privacy Policy from time to time to reflect:

• Changes to our data practices
• New features or services
• Legal or regulatory requirements
• Industry best practices

Material Changes:

For significant changes that materially affect your rights, we will provide notice by:

• Posting a prominent notice on our website at least 30 days before the effective date
• Sending an email to your registered email address
• Displaying an in-app notification when you log in

Non-Material Changes:

For minor changes (e.g., clarifications, formatting, contact information updates), we will update the "Last Updated" date at the top of this Privacy Policy.

14.2 Continued Use Constitutes Acceptance

Your continued use of the Service after the effective date of changes constitutes your acceptance of the updated Privacy Policy.

If you do not agree to the changes:

• Stop using the Service
• Delete your account before the effective date
• Contact us at [email protected] to discuss your concerns

14.3 Version History

Previous versions of this Privacy Policy are available upon request. Contact [email protected] to request historical versions.

---

15. CONTACT INFORMATION

15.1 Privacy Inquiries

For questions, concerns, or requests regarding this Privacy Policy or our privacy practices:

Email: [email protected]
Response Time: We aim to respond within 5 business days

15.2 Data Protection Officer (DPO)

For GDPR-related inquiries or international data transfer questions:

Email: [email protected]

15.3 Exercising Your Rights

To exercise your privacy rights (access, deletion, correction, opt-out):

Email: [email protected]
Subject Line: Privacy Rights Request – [Specify Right]

15.4 Security Concerns

To report a security vulnerability or data breach:

Email: [email protected]

15.5 General Support

For account-related questions or technical support:

Email: [email protected]
Website: https://filingflow.app

15.6 Regulatory Complaints

California Residents:

If you believe your privacy rights have been violated, you can file a complaint with:

California Attorney General
Office of the Attorney General
Privacy Enforcement Section
1300 I Street, Suite 1450
Sacramento, CA 95814
Email: [email protected]
Phone: (916) 210-6276

European Residents (GDPR):

You have the right to lodge a complaint with your local data protection authority (supervisory authority). A list of authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

---

16. ADDITIONAL STATE-SPECIFIC DISCLOSURES

16.1 Nevada Residents

Nevada residents have the right to opt-out of the sale of certain covered information. While we do not currently sell covered information as defined by Nevada law, you can submit an opt-out request to [email protected].

16.2 Virginia, Colorado, Connecticut Residents

Residents of Virginia, Colorado, and Connecticut have the right to opt-out of:

• Targeted advertising
• Sale of personal information
• Profiling in furtherance of decisions that produce legal or similarly significant effects

To exercise these rights, email [email protected] or use the "Do Not Sell or Share" link on our website.

16.3 Other State-Specific Rights

If your state has enacted comprehensive privacy legislation not explicitly listed here, you may have additional rights under state law. Contact [email protected] to exercise state-specific rights or for more information.

---

17. PERSONAL INFORMATION IN PUBLIC SEC FILINGS

17.1 Information Republished from Filings

FilingFlow republishes data from SEC filings as filed. Form D filings in particular often list an issuer's principal place of business and a contact telephone number, which may be a home address or a personal telephone number.

We do not treat this information as a means of identifying or profiling the individuals connected to a filing. We use it only to display the filing record, and we do not sell it or use it for advertising.

17.2 Requesting Suppression

If you are the individual identified in a filing, or an authorized representative, you may ask us to suppress a street address or telephone number from our Service. We apply suppression to every page, API response, and export we control for that filer, while leaving the issuer name, fund name, offering details, and city/state location intact.

Email: [email protected] Subject Line: Filing Suppression Request

Please include:

• The issuer name and CIK (or the filing links) you are asking about
• The specific field you want suppressed (street address, telephone number)
• Your relationship to the filing
• Contact information for our reply

Response Time: We aim to acknowledge suppression requests within 5 business days and to complete verified requests within 30 days.

17.3 Limits of Suppression

Suppression applies only to the surfaces FilingFlow controls. The underlying filings remain publicly available on the SEC's EDGAR system, and other services that republish SEC data may continue to display the same information. Search engines may retain cached copies until they recrawl our pages. We will tell you which parts of a request we can and cannot act on.

17.4 Suppression Records

We keep a record of suppression requests and their outcomes so that suppressed data stays suppressed as filings are re-processed, and so that our decisions are auditable. Revoking a suppression restores the values on the next cache cycle.

---

18. GLOSSARY OF TERMS

Personal Information: Information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household.

Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

Service Provider: A third party that processes personal information on behalf of FilingFlow pursuant to a written contract.

Sale/Sell: Exchanging personal information for monetary or other valuable consideration (CCPA definition).

Sharing: Disclosing personal information to a third party for cross-context behavioral advertising (CCPA definition).

Sensitive Personal Information: Categories of personal information that reveal racial/ethnic origin, religious beliefs, health information, sexual orientation, precise geolocation, or other specified categories under CCPA.

Controller: The entity that determines the purposes and means of processing personal data (GDPR term).

Processor: The entity that processes personal data on behalf of the controller (GDPR term).

---

19. EFFECTIVE DATE AND ACCEPTANCE

This Privacy Policy is effective as of November 21, 2025.

By accessing or using the Service on or after this date, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

Last Updated: November 21, 2025
Version: 1.0

---

END OF PRIVACY POLICY