SSOTA LABS, INC. PRIVACY POLICY

SSOTA Labs, Inc. (the "Company") is committed to maintaining robust privacy protections for its users. Our Privacy Policy ("Privacy Policy") is designed to help you understand how we collect, use, and safeguard the information you provide to us and to assist you in making informed decisions when using our Service.

For purposes of this Agreement:

• "Site" refers to the Company's website, which can be accessed at https://www.ssota.ai.
• "Service" refers to the Company's services accessed via the Site, in which users can create and manage workspaces, upload and organize content, collaborate with others, publish certain pages for external access, and use AI-powered features (collectively, the "Service").
• The terms "we," "us," and "our" refer to the Company.
• "You" refers to you, as a user of our Site or our Service.

By accessing our Site or our Service, you accept our Privacy Policy and Terms of Use (the "Terms of Use"), and you consent to our collection, storage, use, and disclosure of your information as described in this Privacy Policy.

Last Updated: January 30, 2026.

I. INFORMATION WE COLLECT

We collect "Non-Personal Information" and "Personal Information."

Non-Personal Information includes information that cannot be used to personally identify you, such as anonymous usage data, general demographic information we may collect, referring/exit pages and URLs, platform types, device and browser information, preferences you submit and preferences that are generated based on the data you submit, and number of clicks and interactions.

Personal Information includes information that can identify you as an individual, such as your email address, account credentials (e.g., username and password), and any other information you choose to provide to us through your account profile or communications with us.

User Content and Published Content

The Service allows you to upload, submit, or create content ("User Content"), which may include text, documents, images, audio, video, links, notes, and other materials. User Content may include Personal Information if you choose to include it.

The Service may also allow you to publish certain pages or content for access by people outside your workspace (for example, via a public link) ("Published Content"). Published Content may be accessible to the general public or to anyone with the link, depending on your settings. If you include Personal Information in Published Content, that Personal Information may become publicly accessible.

1. Information Collected via Technology

To activate certain features of the Service, you may need to submit Personal Information (such as your email address). To use the Service thereafter, you may provide additional information through your workspace content, settings, or profile.

In an effort to improve the quality of the Service, we track information provided to us by your browser or application when you view or use the Service, such as:

• Referring URL (the website you came from)
• Browser type and version
• Device type and operating system
• IP address (which may be used to derive approximate location)
• Time and date of access
• Pages or screens viewed and features used
• Performance and diagnostic data (e.g., crash reports)

We track this information using cookies and similar technologies, as well as analytics and logging tools. Cookies are small text files which include an anonymous unique identifier, stored on your device. Cookies help us collect Non-Personal Information and keep a record of preferences, both on an individual and aggregate basis.

For example, we may use cookies and similar technologies to:

• Keep you logged in
• Remember preferences and settings
• Measure feature usage and improve performance
• Understand usage trends and improve user experience
• Prevent fraud and enhance security

We may use both persistent and session cookies; persistent cookies remain on your device after you close your session until you delete them, while session cookies expire when you close your browser.

Analytics and Error Monitoring Providers

We may use third-party analytics and error monitoring providers to help us understand how users interact with the Service, measure performance, and diagnose issues. These providers may collect information such as device identifiers, browser and device information, usage events, and crash or diagnostic data. Examples of providers we may use include Mixpanel, PostHog, and Sentry. Any use of such providers will be for service operations, analytics, security, and performance purposes.

2. Information You Provide Us by Registering for an Account

To become a user of the Service, you may need to create an account and enter an email address and create login credentials. By registering, you authorize us to collect, store, and use such information in accordance with this Privacy Policy.

3. Children's Privacy

The Site and the Service are not directed to anyone under the age of 13, and we do not knowingly collect or solicit information from anyone under the age of 13. In addition, the Service is intended for individuals who are at least 18 years old (as stated in our Terms of Use). If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information as soon as possible. If you believe we have collected such information, please contact us at contact@ssota.ai.

II. HOW WE USE AND SHARE INFORMATION

Personal Information

Except as otherwise stated in this Privacy Policy, we do not sell, trade, rent, or otherwise share for marketing purposes your Personal Information with third parties without your consent.

We may share Personal Information with vendors and service providers who perform services for the Company, such as:

• Hosting, storage, and infrastructure providers
• Email delivery and customer support providers
• Security and fraud-prevention providers
• Analytics and error monitoring providers (for service operations, analytics, security, and performance)

Those vendors use your Personal Information only at our direction and in accordance with this Privacy Policy.

In general, we use Personal Information to:

• Create and manage your account
• Provide and operate the Service, including collaboration and publishing features
• Communicate with you (e.g., service notices, security alerts, support)
• Respond to inquiries and provide technical support
• Improve the Service and develop new features
• Enforce our Terms of Use and protect the integrity of the Service

Published Content; Sharing and Public Access

You control whether your content is published or shared outside your workspace. If you choose to publish content or share it via a public link or with people outside your workspace, you acknowledge that:

• Published Content may be accessed, copied, shared, cached, indexed by search engines, screenshot, downloaded, or otherwise redistributed by third parties.
• Company cannot control how third parties use Published Content once it is made available outside your workspace.
• If you later delete or unpublish Published Content, third parties may still retain copies (for example, through caching, archiving, backups, or screenshots), and we do not control such third-party retention.

AI Services and Third-Party Model Providers

The Service may include AI-powered features ("AI Services"), such as generating summaries, transcripts, insights, tags, transformations, or other outputs. To provide these AI Services, we may process your User Content using third-party model providers and related vendors, including, without limitation:

• OpenAI
• Anthropic
• Google (Gemini)
• xAI (Grok)
• ElevenLabs
• TwelveLabs

When you use AI Services, your User Content (which may include Personal Information if you include it) may be transmitted to and processed by these providers for the purpose of generating outputs and providing the AI Services.

We do not use your User Content to train our general-purpose AI models. We also do not permit third-party model providers to use your User Content to train their general-purpose AI models when you use AI Services through our standard integrations. However, you acknowledge that third-party providers may retain data for limited periods for safety, security, or abuse monitoring purposes, and we may not be able to immediately delete data held by such providers during any applicable retention period.

Legal Requirements

We may share Personal Information with outside parties if we have a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to:

• Meet any applicable legal process or enforceable governmental request
• Enforce applicable Terms of Use, including investigation of potential violations
• Address fraud, security, or technical issues
• Protect against harm to the rights, property, or safety of our users or the public as required or permitted by law

Non-Personal Information

In general, we use Non-Personal Information to help us improve the Service and customize the user experience. We may aggregate Non-Personal Information to track trends and analyze usage patterns. This Privacy Policy does not limit our use or disclosure of Non-Personal Information, and we reserve the right to use and disclose such Non-Personal Information to our partners, service providers, and other third parties at our discretion.

Business Transfers

In the event we undergo a business transaction such as a merger, acquisition, reorganization, or sale of all or a portion of our assets, your Personal Information may be among the assets transferred. You acknowledge and consent that such transfers may occur and are permitted by this Privacy Policy, and that any acquirer of our assets may continue to process your Personal Information as set forth in this Privacy Policy.

International Data Transfers

The Company is based in the United States, and we and our service providers may process and store information in the United States and other countries. If you access or use the Service from outside the United States (including Korea or Japan), you understand and consent that your information (including Personal Information and User Content) may be transferred to, processed in, and stored in the United States and other jurisdictions, which may have data protection laws different from those in your country of residence.

III. HOW WE PROTECT INFORMATION

We implement security measures designed to protect your information from unauthorized access. Your account is protected by your password, and we urge you to keep your password confidential and to log out after each use where applicable.

We also use reasonable technical and organizational measures (such as encryption in transit, access controls, and monitoring) designed to protect information. However, no security measures are perfect, and we cannot guarantee that your information will not be accessed, disclosed, altered, or destroyed. By using our Service, you acknowledge and agree to assume these risks.

IV. YOUR RIGHTS REGARDING THE USE OF YOUR PERSONAL INFORMATION

You have the right at any time to opt out of receiving marketing communications from us. When we send a promotional communication, you can opt out by following the unsubscribe instructions in that email, or by contacting us at contact@ssota.ai.

Please note that even if you opt out of marketing emails, we may still send you administrative or transactional emails, such as account notices, security alerts, and updates regarding the Service or this Privacy Policy.

V. LINKS TO OTHER WEBSITES

As part of the Service, we may provide links to third-party websites or services. We are not responsible for the privacy practices employed by those third parties or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Site and Service. We encourage you to read the privacy statements of any third-party websites before using them.

VI. CHANGES TO OUR PRIVACY POLICY

We reserve the right to change this Privacy Policy at any time. We will notify you of significant changes by sending a notice to the primary email address specified in your account (if any) or by placing a prominent notice on our Site. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. You should periodically check the Site and this privacy page for updates.

VII. CONTACT US

If you have any questions regarding this Privacy Policy or the practices of this Site, please contact us by sending an email to contact@ssota.ai.