What Gene knows, and what it does with it.

Personal information you disclose to us

We collect personal information that you voluntarily provide when you express interest in our products and services, participate in activities on the Services, or otherwise contact us. What we collect depends on your interactions with us, the choices you make, and the features you use. This may include contact or authentication data.

We do not process sensitive information.

Application data

If you use our application, we may collect the following if you grant access or permission:

• Geolocation information. We may request access to track location-based information from your device — continuously or while you use the app — to provide location-based services. You can change this in your device settings.

This is primarily needed to maintain the security and operation of the app, for troubleshooting, and for internal analytics and reporting. All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information collected automatically

Some information — such as your IP address and browser or device characteristics — is collected automatically when you visit the Services. It doesn't reveal your specific identity but may include device and usage information, primarily to maintain security and operation and for internal analytics.

• Log and usage data. Service-related, diagnostic, usage, and performance information our servers collect in log files — IP address, device and browser type, activity such as timestamps, pages and files viewed, searches, features used, and error reports.
• Location data. Precise or imprecise device location (for example, via GPS or IP address). You can opt out by refusing access or disabling location on your device, though some features may then be unavailable.
• Chat history data. Data related to the dialogue of chatbot conversations.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information collected from other sources

To improve our marketing, offers, and services, we may obtain information from sources such as public databases, joint marketing partners, affiliate programs, and data providers. This may include mailing addresses, job titles, email addresses, phone numbers, intent data, IP addresses, and social media profiles, for targeted advertising and event promotion.

We process your personal information for a variety of reasons, depending on how you interact with the Services:

• To deliver services you request.
• To respond to inquiries and offer support, resolving any issues with the requested service.
• To send administrative information, such as details about products, and changes to our terms and policies.
• To save or protect a vital interest, such as to prevent harm.

If you are in the EU or UK

The GDPR and UK GDPR require us to explain the legal bases we rely on. We may rely on:

• Consent — permission you've given for a specific purpose, which you can withdraw at any time.
• Performance of a contract — where processing is necessary to fulfill our obligations to you.
• Legal obligations — where necessary for compliance, such as cooperating with law enforcement or defending legal rights.
• Vital interests — where necessary to protect your safety or that of another person.

If you are in Canada

We may process your information with your express or implied consent, which you can withdraw at any time. In some exceptional cases we may be legally permitted to process information without consent — for example, for fraud detection and prevention, certain business transactions, to identify injured or deceased persons, where there are reasonable grounds to believe someone may be a victim of financial abuse, to comply with a subpoena or court order, or where the information is publicly available and specified by regulation.

We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us and need access to do that work. Contracts are in place so they cannot use your information except as we instruct, cannot share it with any organization apart from us, and must protect it to the same standard mandated by the EU-US and Swiss-US Data Privacy Framework Principles.

The third parties we may share personal information with:

We may also share your information in these situations:

• Business transfers — in connection with a merger, sale of assets, financing, or acquisition of our business.
• Affiliates — with our parent company, subsidiaries, and joint-venture partners, who must honor this notice.
• Business partners — to offer you certain products, services, or promotions.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with the Services. Some help us maintain security, prevent crashes, fix bugs, save your preferences, and support basic functions.

We also permit third parties and service providers to use tracking technologies for analytics and advertising — to manage and display ads, tailor them to your interests, or send reminders depending on your preferences. To the extent this is deemed a "sale" or "sharing" under applicable US state laws, you can opt out via the request described in section 12. Specific details are set out in our Cookie Notice.

Google Analytics

We may share your information with Google Analytics to track and analyze use of the Services. You can opt out of Google Analytics across the Services at tools.google.com/dlpage/gaoptout.

As part of our Services, we offer AI-powered products, features, and tools ("AI Products") designed to enhance your experience. The terms in this notice govern your use of them.

Use of AI technologies

We provide AI Products through third-party service providers ("AI Service Providers"), including OpenAI. Your input, output, and personal information will be shared with and processed by these providers to enable your use of the AI Products. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI products

Our AI Products are designed to provide AI bots.

How we process your data using AI

All personal information processed using our AI Products is handled in line with this notice and our agreements with third parties, to maintain security and safeguard your information throughout.

Our servers are located in the United States. If you access the Services from outside the US, your information may be transferred to, stored, and processed in the United States and other countries where we or our third parties operate.

If you reside in the EEA, UK, or Switzerland, these countries may not have data-protection laws as comprehensive as your own. We take all necessary measures to protect your information in accordance with this notice and applicable law.

We keep your personal information only as long as necessary for the purposes set out here, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process it, we will delete or anonymize it — or, if that isn't possible (for example because it's held in backup archives), securely store and isolate it from further processing until deletion is possible.

We've implemented appropriate and reasonable technical and organizational security measures designed to protect the information we process. However, no electronic transmission or storage technology can be guaranteed 100% secure, so we cannot promise that unauthorized third parties will never defeat our security. Transmission of personal information to and from the Services is at your own risk — please access the Services within a secure environment.

In some regions (such as the EEA, UK, Switzerland, and Canada) you have rights under applicable data-protection law. These may include the right to request access and obtain a copy of your information; request rectification or erasure; restrict processing; where applicable, data portability; and not to be subject to automated decision-making. You may also, in certain circumstances, object to processing. Contact us using the details in section 14 to make a request.

• If you are in the EEA or UK and believe we are unlawfully processing your information, you may complain to your local data-protection authority.
• If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

Where we rely on your consent, you can withdraw it at any time by contacting us. This won't affect the lawfulness of processing before withdrawal, or processing carried out on other lawful grounds.

Opting out of marketing

You can unsubscribe from marketing communications at any time via the unsubscribe link in our emails or by contacting us. We may still send you service-related messages necessary for the administration of your account.

Most browsers and some mobile systems include a Do-Not-Track ("DNT") setting. Because no uniform technology standard for recognizing and implementing DNT signals has been finalized, we do not currently respond to DNT browser signals or any similar mechanism. If a standard is adopted that we must follow, we'll update this notice. California law requires us to note that, absent an industry or legal standard, we do not respond to DNT signals at this time.

If you reside in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the right to request details about the personal information we maintain about you and how we've processed it, correct inaccuracies, obtain a copy, or delete it. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect

Collected in the past twelve months:

We may also collect other personal information when you interact with us in person, online, or by phone or mail — for example through customer support, surveys or contests, and delivery of our Services.

Will your information be shared with anyone else?

We may disclose your personal information to service providers under written contract. We may also use it for our own business purposes, such as internal research for technological development — this is not considered "selling." We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve months.

Your rights

Under certain US state laws, subject to limits, you have the right to:

• Know whether we are processing your personal data.
• Access, correct inaccuracies in, and obtain a copy of your data.
• Request deletion of your personal data.
• Non-discrimination for exercising your rights.
• Opt out of processing for targeted advertising, sale, or profiling with legal or similarly significant effects.

Depending on your state, you may also have the right to obtain a list of categories (or specific third parties, in Oregon) to which we've disclosed data, to limit use of sensitive data (California), or to opt out of collection of sensitive data and data from voice or facial recognition features (Florida).

How to exercise your rights

Submit a data subject access request, email contact@askgene.io, or use the contact details below. You may designate an authorized agent, who must provide valid written proof of authorization. We will verify your identity before acting, using the information you provide only for verification. If we decline your request, you may appeal by emailing us; if your appeal is denied, you may complain to your state attorney general.

California "Shine The Light"

California residents may request, once a year and free of charge, information about categories of personal information we disclosed to third parties for their direct marketing purposes. Submit requests in writing using the contact details below.

We may update this notice from time to time, indicated by a revised date at the top. If we make material changes, we may notify you by prominently posting a notice or by sending a direct notification. We encourage you to review it frequently.

You have the right to request access to the personal information we collect, details about how we've processed it, correction of inaccuracies, or deletion. You may also request that we limit the use or disclosure of your personal information, or withdraw your consent to processing. These rights may be limited in some circumstances by applicable law. To review, update, or delete your personal information, please fill out and submit a data subject access request.