Privacy Policy

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include:

• Names
• Email addresses
• Phone numbers
• Usernames
• Passwords
• Contact preferences
• Contact or authentication data
• Billing addresses
• Debit/credit card numbers
• Business names

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information: financial data.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by Stripe. You may find their privacy notice at stripe.com/privacy.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Google or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice at truecast.org/cookies.

The information we collect includes:

• Log and Usage Data — service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services, including your IP address, device information, browser type and settings, and information about your activity in the Services (date/time stamps, pages and files viewed, searches, and other actions you take).
• Device Data — information about your computer, phone, tablet, or other device you use to access the Services, including IP address, device and application identification numbers, location, browser type, hardware model, Internet service provider, operating system, and system configuration information.
• Location Data — information about your device's location, which can be either precise or imprecise, based on your IP address. You can opt out of allowing us to collect this information by disabling your Location setting on your device.

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The GDPR and UK GDPR require us to explain the valid legal bases we rely on:

• Consent — We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a Contract — We may process your personal information when it is necessary to fulfill our contractual obligations to you, including providing our Services.
• Legitimate Interests — We may process your information when it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, to send information about special offers, develop personalized advertising, analyze how our Services are used, support marketing activities, diagnose problems and prevent fraud, and improve user experience.
• Legal Obligations — We may process your information where necessary for compliance with our legal obligations.
• Vital Interests — We may process your information where necessary to protect your vital interests or the vital interests of a third party.

We may process your information if you have given us specific permission (express consent) or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time. In some exceptional cases, we may be legally permitted to process your information without your consent, including:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations

We may share your information with Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics across the Services, visit tools.google.com/dlpage/gaoptout. You can opt out of Google Analytics Advertising Features through Ads Settings and Ad Settings for mobile apps. Other opt-out means include optout.networkadvertising.org and networkadvertising.org/mobile-choice. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

We provide the AI Products through third-party service providers ("AI Service Providers"), including OpenAI, LLC and Anthropic, PBC. When you use the AI Copilot feature, your messages and relevant financial data are transmitted to one of these AI Service Providers to generate a response. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products are designed for the following functions:

• AI financial insights and question answering (Copilot)
• AI predictive analytics and forecast modelling
• Natural language processing for financial planning queries

When you use the AI Copilot, the following data may be transmitted to our AI Service Providers to generate a relevant response:

• Your chat messages and conversation history (up to the last 10 turns)
• Your company's financial model assumptions (revenue growth rates, OPEX, CAPEX, margins) when your query relates to those figures
• The name of the page you are currently viewing within the application
• Metric names and values you have selected for discussion

We do not send raw uploaded financial statements, bank transaction exports, or personally identifiable information beyond what you type in the chat. You can review the AI Service Providers' privacy practices at openai.com/privacy and anthropic.com/privacy.

If you are located in the European Economic Area or the United Kingdom, our legal basis for transmitting your data to AI Service Providers is:

• Performance of a contract — processing is necessary to provide the AI Copilot feature you have requested as part of our Services.
• Legitimate interests — we have a legitimate interest in improving the accuracy and usefulness of AI-generated financial insights, provided this does not override your fundamental rights.

AI personal information processed using our AI Products is handled in line with our Privacy Notice and our data processing agreements with each AI Service Provider. OpenAI and Anthropic do not use API request data to train their models by default; data is processed solely to return your response and is subject to each provider's retention policies (typically 30 days for abuse monitoring).

If you wish to limit AI data processing, you may stop using the AI Copilot feature at any time. No AI processing occurs unless you actively send a message in the Copilot panel.

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us using the contact details provided in Section 16 below. Please note that this will not affect the lawfulness of the processing before its withdrawal.

You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in Section 16 below. You will then be removed from the marketing lists. However, we may still communicate with you for service-related purposes.

Phone and SMS communications. We collect your phone number at the time of account registration to contact you about your account, subscription status, and important service updates. We do not use your phone number for unsolicited marketing calls or SMS campaigns. If you wish to opt out of non-essential phone contact, please email us at privacy@truecast.org.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with third parties.

If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at privacy@truecast.org.

The table below shows the categories of personal information we have collected in the past twelve (12) months.

We only collect sensitive personal information as defined by applicable privacy laws or for purposes allowed by law or with your consent. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

We will use and retain the collected personal information as follows:

• Category A — As long as the user has an account with us
• Category B — As long as the user has an account with us
• Category D — As long as the user has an account with us
• Category F — As long as the user has an account with us
• Category G — As long as the user has an account with us
• Category I — As long as the user has an account with us
• Category L — As long as the user has an account with us

You have rights under certain US state data protection laws, including:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including Minnesota and Oregon)
• Right to review, understand, question, and correct how personal data has been profiled (as permitted by applicable law, including Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including Florida)

To exercise these rights, you can contact us by visiting truecast.org/account, by emailing us at privacy@truecast.org, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at privacy@truecast.org. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. This Privacy Notice satisfies the notice requirements defined in both Privacy Acts, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.

If you do not wish to provide the personal information necessary to fulfill their applicable purpose, it may affect our ability to provide our services, including the ability to offer you the products or services that you want, respond to or help with your requests, manage your account with us, and confirm your identity and protect your account.

At any time, you have the right to request access to or correction of your personal information by contacting us using the details provided in Section 17 below. If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand's Privacy Principles to the Office of New Zealand Privacy Commissioner.

At any time, you have the right to request access to or correction of your personal information by contacting us using the details provided in Section 17 below.

If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator:

The Information Regulator (South Africa)

• General enquiries: enquiries@inforegulator.org.za
• Complaints (complete POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za