>_ STRIKERATES PRIVACY POLICY

1. INFORMATION WE COLLECT

• Voluntary Information (Employees): We collect information you provide directly, such as your email address, company name, employment status, and estimated equity value.
• Voluntary Information (Capital Providers): We collect business contact information and structural details (e.g., fund name, contact name, work email, capital structure, and target asset stage) when you join the supply-side waitlist.
• Automated Information: We automatically collect certain data when you visit our site, including your IP address, device type, browser type and version, operating system, pages visited, time spent on pages, referring URL, and session duration. This data is collected through cookies and analytics services to improve user experience and platform performance.

2. HOW WE USE YOUR INFORMATION

• To create an anonymized "Asset Profile" for the purpose of providing analytics, powering platform functionality, and enabling integrations.
• To assess ecosystem integrations and provide infrastructure participants with API schema documentation and updates during our phase 0 demand validation.
• To communicate updates regarding your inquiry.
• To analyze platform performance, improve platform services, and assess market demand.

3. OUR TECH STACK & DATA SECURITY

We prioritize the security of your financial data through the following providers:

• Supabase: Used for secure data storage and authentication. Data is encrypted at rest and in transit.
• Google Analytics: Used to understand site traffic and usage patterns.
• Microsoft Clarity: Used to analyze user behavior through session recordings. Note: All sensitive input fields are masked; we do not record keystrokes or sensitive financial figures entered into form fields.
• Reddit Pixel: Used to measure the effectiveness of advertising campaigns on Reddit. This pixel collects page visit and conversion event data (such as signups and form submissions) to attribute ad performance. No personally identifiable information is shared with Reddit through this pixel.

4. DATA SHARING & ANONYMIZATION

Your privacy is our core value. We do not sell your PII to third parties.

• Ecosystem Integrations: We share anonymized data payloads (e.g., "$1M in Vested Options at [Company X]") within our infrastructure to support advanced analytical modeling by ecosystem participants.
• Consent: Your identity is only shared with an ecosystem participant if you explicitly choose to authenticate and integrate your profile.

5. COOKIES

We use cookies and similar tracking technologies to operate the Site and collect usage data. These fall into two categories:

• Essential Cookies: Required for authentication, session management, and core platform functionality (set by Supabase).
• Analytics Cookies: Used by Google Analytics, Microsoft Clarity, and Reddit Pixel to understand traffic patterns, user behavior, ad attribution, and page performance. These cookies do not store personally identifiable information.

You can manage or disable cookies through your browser settings. Disabling essential cookies may affect platform functionality.

6. DATA RETENTION

We retain your personal information for as long as your account is active or as needed to provide you with our services. Waitlist data is retained for the duration of the market validation phase and any subsequent platform launch. You may request deletion of your data at any time by contacting us. Upon receiving a verified deletion request, we will remove your personal information from our active systems within 30 days, except where retention is required by law.

7. YOUR RIGHTS

Depending on your location, you may have specific rights regarding your personal data:

• All Users: You may request access to, correction of, or deletion of your personal data at any time.
• California Residents (CCPA/CPRA): You have the right to know what personal information we collect, request its deletion, and opt out of the sale of your personal information. We do not sell your personal information. To submit a request, contact us at the email below.
• EEA/UK Residents (GDPR): You have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us. We will respond to verified requests within 30 days.

8. THIRD-PARTY LINKS

The Site may contain links to third-party websites, including liquidity provider platforms, external data sources, and educational references. StrikeRates is not responsible for the privacy practices, content, or accuracy of these external sites. We encourage you to review the privacy policies of any third-party site you visit through links on our platform.

9. AGE RESTRICTION

StrikeRates is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected data from someone under 18, we will delete it promptly.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Your continued use of the Site after any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.