Privacy Policy

This Privacy Policy (the "Privacy Policy") applies to all associated applications owned or operated by the Veteran Ai, Inc., and their subsidiaries and affiliates (collectively, the "Company") including, but not limited to, the downloadable Company application and the non-downloadable web application known as VeteranAi (collectively, the "Apps"). The Apps are the property of the Company and its licensors.

This Privacy Policy describes Company policies and procedures on the collection, use and disclosure of your information when you use the Apps and tells you about your privacy rights and how the law protects you.

You acknowledge and agree that by downloading, browsing, or otherwise using the content, services and tools offered by the apps, you have agreed, without limitation or qualification, to be bound by this privacy policy and any additional terms that may apply. If you do not agree with this Agreement, please do not download or use the Apps.

The Company reserves the right, at its sole discretion, to change, modify, add, or remove portions of this Privacy Policy, at any time, consistent with applicable law. You agree to be bound by this Agreement and any amendments made thereto in the future so long as you utilize the Apps.

It is your responsibility to check this Agreement periodically for changes. The Company will post a notification on the Apps or otherwise provide notice to you if the Privacy Policy materially changes. Such changes, whether in the form of modifications, additions, or deletions, shall become effective when specified in the relevant notification. If you do not agree to the changes, uninstall and do not continue to use the Apps after the date they become effective. Your continued use of the Apps following the posting of changes will mean that you accept and agree to the changes.

What Personal Data Do We Collect

While using the Apps, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Email address
• First and last name
• Phone number
• Usernames and passwords
• Contact preferences
• Military records
• Social Security Numbers (deleted regularly in accordance with Company's recordkeeping security policies)
• Health data
• Mailing address, state, province, zip/postal code, city
• Usage data
• Payment data (stored and regulated by Stripe)

We Collect Certain Usage Data

Usage Data is collected automatically when using the Apps.

Usage Data may include information such as the type of mobile device you use, App data or locations that you access, time spent accessing such data or locations, and other diagnostic data.

While using the Apps, in order to provide features of the Apps, we may also collect the following information that is automatically sent by your browser or device:

• IP addresses
• Information regarding your location (derived from IP address)
• Device type information
• Browser type information
• Referring URLs

We use this information to provide features of the Apps and to improve and customize the Apps. The information may be uploaded to the Company's servers and/or a Service Provider's server, or it may be stored in your Device.

Use of Your Personal Data

We do not sell your data for profit or monetary value.

We do not use your documents, messages, or account data to train AI models, and our AI providers are contractually prohibited from doing so. We use aggregated, de-identified metrics (such as feature usage and error rates) only to operate and improve the service. We will not re-identify this data or share it without your explicit consent.

Some data, such as genetic or family history information, may relate to individuals other than yourself. Sharing such data may impact those individuals. We will not share or disclose this information (including in de-identified form) without your explicit consent.

The Company may use Personal Data for the following purposes:

• To provide and maintain the Apps, including to monitor usage of the Apps.
• To manage your account and your registration as a user of the Apps. The Personal Data you provide can give you access to different functionalities of the Apps that are available to you as a registered user.
• For the performance of a contract: the execution, compliance and undertaking of the purchase contracts for products, items or services you may purchase through the Apps or any other Service that are available to you as a registered user.
• To contact you by email, phone, SMS text, or other equivalent form of electronic communication such as push notifications regarding updates or informative communications related to the functionalities, products, or contracted services, including security updates, when necessary or reasonable for their implementation.
• To provide you with news and offers as well as general information about other goods, services and events which we offer that are similar to those that you have already purchased or inquired about, unless you have opted not to receive such information.
• To manage your requests to us as part of our customer support.
• For business transfers: we may use your Personal Data to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us about the Apps users is among the assets transferred
• For other purposes: we may use your Personal Data for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and to evaluate and improve the Apps, Services, products, marketing and your experience.

We may share your Personal Data in the following situations:

• With Service Providers: we may share your Personal Data with Service Providers to monitor and analyze the use of the Apps, and to provide marketing, promotional, and communication services related to our products and services.
• With Affiliates: we may share your Personal Data with our Affiliates, in which case we will require those Affiliates to honor this Privacy Policy. Affiliates include any parent company, other subsidiaries, joint venture partners, or other companies that we control or are under common control with us.
• With business partners: we may share your Personal Data with our business partners to offer you certain products, services or promotions.
• With your consent: we may choose to disclose your personal information for any other purpose with which you consent.

We may share your Personal Data with the following categories of third-party service providers, who process it only to provide services to us:

• Payment processing
• Cloud hosting and infrastructure
• Database, storage, and authentication
• Email, SMS, and other customer communications
• Marketing, analytics, and engagement
• Logging, monitoring, and error tracking

We engage these service providers under written agreements that require them to safeguard your Personal Data and to use it only to provide services to us, consistent with applicable law. You may request the specific service providers we currently use by emailing us at team@veteranai.co.

These service providers may not use, disclose, sell, or re-identify any user data — including de-identified, anonymized, or pseudonymized data — for their own purposes without your prior consent.

AI Disclaimer and User Responsibility

Our Apps use artificial intelligence to generate certain content and documents. While we strive for accuracy, AI-generated outputs may not be perfect. You are responsible for verifying and ensuring the content suits your needs, especially before submitting to third parties (including the VA). We disclaim any responsibility for the outcomes of AI-generated documents you submit.

Retention of Your Personal Data

The Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (e.g. compliance with applicable laws and regulations), resolve disputes, and enforce our legal agreements and policies. The Company will also retain Usage Data for internal analysis purposes.

If your account remains inactive for two (2) years, we will retain your data for this period. After this time, your data will be permanently deleted unless you reactivate your account. You will receive confirmation by email once your data has been deleted in response to your request.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. As such, this information and Personal Data may be transferred to and maintained on computers located outside your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction.

Your consent to this Privacy Policy, coupled with your submission of such information and Personal Data, represents your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and that no transfer of your Personal Data will take place to an organization or jurisdiction unless there are adequate controls in place to secure and protect your Personal Data and other information.

Permanent Deletion of Your Personal Data

You have the right to request that the Company erase your personal data in certain circumstances provided by law. Upon receipt of your request, the Company will permanently delete 100% of your data from our systems, including all personal information, VA and non-VA data, within 45 days.

Third-Party Social Media Services

The Company allows you to create and log in to use the Apps through Third-Party Social Media Services, including but not necessarily limited to: Google and/or Discord.

If you decide to register through or otherwise grant us access to a Third-Party Social Media Service, we may collect Personal Data that is already associated with your Third-Party Social Media Service's account, such as your name, your email address, your activities or your contact list associated with that account.

You may also have the option of sharing additional information with the Company through your Third-Party Social Media Service's account. If you choose to provide such information and Personal Data, during registration or otherwise, you are giving the Company permission to use, share, and store such Personal Data and information in a manner consistent with this Privacy Policy.

Disclosure of Your Personal Data

Business Transactions. If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred or disclosed. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

If there is a change in company ownership, you will be notified and may choose to delete your data, close your account, or download/transmit your records. The new owner will be required to uphold our current privacy commitments, or you will be notified and given the option to opt-out and delete your data.

Law Enforcement. Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities such as a court order or government agency.

Other Legal Requirements. The Company may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company or its Affiliates
• Prevent or investigate possible wrongdoing in connection with the Apps
• Protect the personal safety of Users of the Apps or the general public
• Protect against legal liability

Security of Your Personal Data

The security of your Personal Data is important to us; however, no method of transmission over the internet, or method of electronic storage is ever 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Notice for Residents of Certain U.S. States

U.S. State consumer privacy laws may provide their residents with additional rights regarding our use of their Personal Information. In certain circumstances, some U.S. States, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia provide their state residents with some or all of the following rights:

• Right to Access: You may have the right to request details about the Personal Information we have collected in the past twelve (12) months, including data categories, sources, purposes for collection, and third-party sharing.
• Right to Confirm Processing: You may request confirmation as to whether and what Personal Information we process.
• Right to Correct: You may have the right to request that we correct inaccuracies in Your Personal Information, taking into account the information's nature and processing purpose (excluding Iowa and Utah).
• Right to Portability: You may have the right to request the transfer of your Personal Information to another organization or directly to you under certain conditions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Exercise of Rights: The exact scope of these rights may vary by state. To request access to or deletion of your personal information, or to exercise any other data rights under applicable U.S. State Law, please email us at team@veteranai.co. Be sure to include your full name, email address, the subject line "Data Subject Request," and the purpose of your request to ensure a prompt response.

Response Timing and Format: We aim to fulfill requests within thirty (30) days. If additional time is required, we will inform you in writing of the reason and the extended timeframe.

For purposes of requests to delete, correct and to know, we will verify your identity based on information we have collected about you, including your name, address, and phone number, but will not fulfill your request unless you have provided sufficient information that enables us to reasonably verify that you are the individual about whom we collected the Personal Information. If we are unable to verify your identity, we may deny your request.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Under California Civil Code Section 1798.83 (the "Shine the Light" law), California residents can request information about our disclosures of Personal Information to third parties for their direct marketing purposes over the past calendar year. To submit a request, please email us at team@veteranai.co with "Request for California Privacy Information" in the subject line. We will respond within thirty (30) days, or as required by law, including only relevant information. Note that certain data sharing may not fall under "Shine the Light" requirements.

Nevada provides its residents with a limited right to opt-out of certain Personal Information sales. Residents who wish to exercise this sale opt-out rights may submit a request. However, please know we do not currently sell Personal Information triggering that statute's opt-out requirements.

Rights for Residents of the EEA, the UK, Switzerland, and Canada

If you are a resident of the United Kingdom ("UK") or European Economic Area ("EEA"), you may have certain data protection rights. "GDPR" means the European Union General Data Protection Regulation (EU) 2016/679, and the United Kingdom Data Protection Act 2018.

If you are a resident of Canada, you may have certain data protection rights under the Personal Information Protection and Electronic Documents Act (PIPEDA).

Information that you provide may be transferred or accessed by entities around the world as described in this Privacy Policy. If you are located in the EEA, UK, Switzerland, or Canada, you freely consent to the transfer of personal information outside of these countries and regions. Your consent to this Privacy Policy together with your submission of personal information constitute your agreement to these transfers. If you are accessing or using the Service from within the EEA, UK, or Switzerland, you may have the following rights under the GDPR (as well as other rights). If you are accessing or using the Service from within Canada, you may have the following rights under PIPEDA (as well as other rights).

• Right to access. You have the right to request confirmation of whether VeteranAi processes personal data relating to you, and if so, to request a copy of that personal data;
• Right to rectification. You have the right to request that VeteranAi corrects or updates your personal data that is inaccurate, incomplete or outdated;
• Right to restrict processing. You have the right to request that VeteranAi restrict the use of your personal data in certain circumstances;
• Right to object to processing. You have the right to object to Veteran's processing of your personal data, under certain conditions, such as when VeteranAi is processing another request you have submitted; and
• Right to data portability. You have the right to request that VeteranAi export the data that we have collected to you or another company, under certain conditions.

Where the processing of your personal data is based on your previously given consent, you have the right to withdraw your consent at any time. If you would like to exercise any of these rights, please email us at team@veteranai.co. You must include your full name, email address, and postal address in your email or mail request so that we can verify your EEA, the UK, Swiss, or Canadian residence and respond. We may further require additional information to verify your identity before processing your request. We will comply with your request when required by applicable law. You also have the right to lodge a complaint about our data collection and processing actions with the appropriate supervisory authority. You can view the contact information for your data protection authority here.

VeteranAi shall respond to requests from data subjects exercising their rights within the following timeframes:

• Standard Response Time: Requests shall be addressed without undue delay and, at the latest, within thirty (30) days from the date the request is received.
• Extension for Complex Requests: Where a request is complex or multiple requests are made by the same data subject, VeteranAi may extend the response period by an additional sixty (60) days. VeteranAi shall inform the data subject of the extension and provide reasons for the delay within the initial thirty (30) days period.
• Request Clarification: If additional information is required to identify the data subject or clarify the request, the response period shall commence upon receipt of the required information.
• Request Refusal: If a request is unfounded, excessive, or repetitive, VeteranAi may refuse to act on it or charge a reasonable fee to cover administrative costs. The data subject shall be notified of the refusal, the reasons for it, and their right to lodge a complaint with a supervisory authority within thirty (30) days of the refusal decision.
• Acknowledgment: VeteranAi will acknowledge receipt of the request as soon as practicable to ensure transparency and communication with the data subject.

Children's Privacy

The Apps do not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13 without verification of parental consent. If you are a parent or guardian of a child younger than 13 and you are aware that your child has provided us with Personal Data, please contact us immediately. If we become aware that we have collected Personal Data from anyone under the age of 13 without verification of parental consent, we take steps to remove that information from our servers.

If your jurisdiction requires consent from a parent for provision of Personal Data or other information, we will require a parent or legal guardian's consent before collecting and using information of a minor.

Links to Other Websites

The Apps may contain links to other websites that are not operated by the Company or its Affiliates. If you click on a third-party link, you will be directed to that third party's site. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the Privacy Policy of every site that you visit.

Changes to this Privacy Policy

We reserve the right to update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy in this space or by other push notifications, emails, or prominent notice.

Breach Notification Procedures

If a data breach occurs, we will take necessary steps to stop the breach and remediate the effects of the breach. We will notify affected users without undue delay by email and through in-app notification, providing instructions for further action and support. In compliance with local laws, we will provide any additional notifications required.

Cookie Policy

The Apps may use cookies and similar technologies to improve user experience, for performance and analytics, and to improve our content, products, and services. A "cookie" is a small text file that a web server stores in browser software. A browser sends cookies to a server when the browser makes a connection to that server (for example, when requesting a web page from the same domain that created the cookie).

The general purpose of cookies is to remember a browser over time and distinguish one browser instance (or user) from all others. Some cookies and other technologies may track the personal data users provide when they interact with a site, and may store such personal data. We use first-party and third-party cookies to ensure that our Apps and websites function properly, to understand how individuals use and engage with our Apps and websites and to analyze and improve our Apps and websites. For example, we use cookies to help you reset your account password in the event you need to. We also use third-party cookies to analyze and improve our Apps and websites so that we can report on usage activities and trends.

Most browsers are initially set up to accept cookies, but you can reset your browser to block or delete all cookies in your browser's settings using the links provided below. Please note that if you block essential cookies, certain parts of the Site may not function properly.

• Chrome: https://support.google.com/chrome/answer/95647?hl=en
• Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-deletemanage-cookies
• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
• Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Opera: https://help.opera.com/en/latest/web-preferences/#cookies

Definitions

For purposes of this Privacy Policy:

• Account means a unique account created by you to access the Apps or Company Services.
• Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Application means the software program(s) described above, provided by the Company and downloaded by you on any electronic device.
• Device means any device that can access the Apps, such as a computer, cellphone, or digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Application/App and provision thereof.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, and to perform services related to the Service or to assist the Company in analyzing how the Service is used.
• Third-Party Social Media Service refers to any website or any social network platform through which a User can log in or create an account to use the Service.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
• User means the individual accessing or using the Service or the Application(s), or the legal entity on behalf of which such individual is accessing or using the Service or the Application(s), as applicable.