PRIVACY POLICY

Effective Date: August 1, 2026Last Updated: July 12, 2026

One Unified Policy Covering the Hutfin Platform and All AI Features (Including hutfin.ai)

This is Hutfin's single Privacy Policy. It covers hutfin.com, hutfin.ai, the "Hutfin" mobile apps (iOS/Android), our APIs, all AI Features, and related services (together, the "Platform"). It is incorporated into and should be read with the Hutfin Terms of Service (https://dev.hutfin.com/terms) and Cookie Policy (https://dev.hutfin.com/cookie-policy). Investor-specific disclosures appear at https://dev.hutfin.com/investor-disclosures and in the applicable Offering Documents. Our AI subprocessors are listed at https://dev.hutfin.com/ai-subprocessors.

Contents

NOTICE AT COLLECTION AND SUMMARY OF OUR PRIVACY PRACTICES

We recommend reading the full Privacy Policy below. This summary is only a brief overview.

Hutfin Global Technologies, Inc. and its affiliates ("Hutfin," "we," "us," "our") operate an AI-powered commercial real estate (CRE) marketplace with fractional ownership features. We collect contact details, account credentials, communications, listing and property information, and data about your activity on the Platform. Depending on the features you use, we also collect transactional and financial details, government identification and KYC data, investor accreditation and suitability data, geolocation data, AI prompts and interactions, and (with consent where required) biometric verification data.

We use personal information to provide the Platform, process transactions and investments, operate AI Features, verify identity and eligibility, prevent fraud, comply with securities, AML, tax, and other laws, communicate with you, improve our services, and (with controls and consent where required) for marketing.

We do NOT sell personal information as "sell" is defined under U.S. state privacy laws. We do NOT use the content of your AI prompts or AI outputs to train generative AI models without your express opt-in consent. We never use investor suitability data for advertising or AI training under any circumstance. We do not currently serve third-party display ads. If we ever "share" personal information for cross-context behavioral advertising, you can opt out via account settings, the "Do Not Sell or Share My Personal Information" link in our site footer, or a Global Privacy Control (GPC) browser signal, which we honor.

To exercise privacy rights, email privacy@hutfin.com or support@hutfin.com with the subject "Privacy Rights Request," or use our online form at https://dev.hutfin.com/privacy-request.

1. WHO WE ARE; WHO CONTROLS YOUR PERSONAL INFORMATION

Controller. Unless otherwise stated, Hutfin Global Technologies, Inc. (a Delaware corporation) is the controller of Personal Information collected through the Platform, including hutfin.com and hutfin.ai.

Issuing Entity Data. Where you subscribe to or hold a Fractional Interest, certain data (KYC/AML records, accreditation documentation, subscription agreements, capital account and distribution records, tax forms) may be controlled jointly or separately by the special purpose vehicle or other Issuing Entity for that asset, as identified in the applicable Offering Documents and at https://dev.hutfin.com/investor-disclosures.

Payments and Securities Roles. Payment information may also be controlled or processed by the payment entities identified in Section 10 and in our Terms of Service. Where a registered broker-dealer, funding portal, alternative trading system, transfer agent, or escrow agent participates in an offering, that entity acts as an independent controller or processor for its regulated functions and is identified in the applicable Offering Documents.

Insurance. Insurance or protection products, if offered, are controlled or processed by the insurer or administrator named in the applicable documentation.

Regional Representatives. Where required, Hutfin appoints an EU/UK representative, a UAE representative, and local contacts for APAC regimes (PIPL, DPDP, APPI). Current appointments are published at https://dev.hutfin.com/privacy-policy.

Privacy Lead. Hutfin designates a privacy lead responsible for this Policy, reachable at privacy@hutfin.com.

Business Details (U.S.) Hutfin Global Technologies, Inc. 1720 Stratton Dr, Virginia Beach, VA 23456, USA Privacy email: privacy@hutfin.com. General: support@hutfin.com (Alt: director@hutfin.com) Website: https://dev.hutfin.com and https://www.hutfin.ai

If you are a current or former Hutfin job applicant, employee, owner, director, officer, or contractor, contact privacy@hutfin.com for the workforce privacy notice that applies to you; this Policy does not cover workforce data.

2. TYPES OF PERSONAL INFORMATION WE COLLECT AND WHY

The categories below describe what we collect, with examples and our purposes and legal bases (contractual necessity, legitimate interests, consent, legal obligation, or vital/public interest, as applicable under GDPR/UK GDPR and similar laws). Sensitive categories are flagged; where law requires consent for a sensitive category, we ask for it at collection.

  • (a) Contact Information. Name, alias, postal address, email, phone. Purpose: account management, service delivery, support, notices, marketing with controls. Basis: contract; legitimate interests; consent where required.
  • (b) Account Credentials. Username, password, authentication tokens, multi-factor data. Purpose: secure access, prevent unauthorized use. Basis: contract; legitimate interests.
  • (c) Identification and Government Records (sensitive). Government ID images, driver's license, passport, SSN or tax ID, KYC selfies, license numbers. Purpose: identity verification, KYC/AML/CFT and sanctions screening, tax reporting, regulatory compliance. Basis: legal obligation; contract; consent where required.
  • (d) Payment and Financial Information (sensitive). Bank account details, payment instrument data (held by our processors), balances and transaction history obtained via Plaid with your authorization, proof of funds, income or net-worth documentation for accreditation. Purpose: process payments, subscriptions, distributions, and refunds; verify investor eligibility; AML and fraud prevention; tax reporting. Basis: contract; legal obligation; consent where required.
  • (e) Investor Suitability and Accreditation Data (sensitive). Accredited-investor or eligibility certifications and supporting documentation, source-of-funds attestations, subscription agreements, capital account and distribution history, tax forms (W-9, W-8BEN, K-1/1099 data). Purpose: comply with the securities exemption for each offering, administer investments, required recordkeeping. Basis: legal obligation; contract. Never used for advertising or AI training.
  • (f) Business and Employment Information. Company, role, title, broker license number, professional history. Purpose: verify credentials, professional directories, facilitate business communications. Basis: legitimate interests; contract; legal obligation where applicable.
  • (g) Transactional and Commercial History. Properties and services viewed, considered, purchased, leased, or invested in; bids; saved searches; leads. Purpose: provide the marketplace, personalize recommendations, analytics, records. Basis: contract; legitimate interests.
  • (h) Listing Content, User Content, and Property Information. Listings, photos, videos, documents, data-room contents, messages, reviews, forum posts, and metadata in uploaded files. Purpose: operate the marketplace, display content as you direct, moderation, safety. Basis: contract; legitimate interests.
  • (i) AI Inputs, Outputs, and Interaction Data. Prompts, questions, instructions, messages, files, documents, images, and data you submit to AI Features ("Inputs"); the responses, summaries, drafts, analyses, valuations, images, and other content generated for you ("Outputs"); chat and session history; feedback such as ratings and corrections; feature settings; and telemetry about AI usage. Purpose: operate the AI Features and the other purposes in Section 6. Basis: contract; legitimate interests; consent where stated in Section 6.
  • (j) User Activity and Interaction Data. Log-on activity, search history, pages and listings viewed, clicks, session recordings of interactions with our interface (such as cursor movement and scrolling), inquiry submissions, and audio or video from customer support calls where permitted, with notice. Purpose: operate and personalize the Platform, quality, security, fraud prevention, analytics, UX improvement. Basis: legitimate interests; consent where required.
  • (k) System and Device Information. IP address, browser type, operating system, device model and identifiers, app usage data, push tokens, language settings, crash logs. Purpose: security, authentication, notifications, diagnostics, analytics. Basis: legitimate interests.
  • (l) Geolocation Data (precise geolocation is sensitive). IP-derived approximate location; precise device location only if you enable it. Purpose: relevant search results, maps, localized features, fraud prevention. Basis: legitimate interests for approximate; consent for precise. You can disable location in device settings at any time.
  • (m) Messaging and Communications Data. Messages sent through the Platform (inquiries to brokers or sellers, support tickets, chats), email engagement (opens, clicks) via standard tracking technologies. Purpose: deliver communications, support, records, safety and fraud review as described in Section 4. Basis: contract; legitimate interests.
  • (n) Demographic Information (some elements sensitive). Optional profile fields such as language preference or, where lawfully collected for surveys, characteristics you volunteer. Purpose: personalization, research. Basis: consent; legitimate interests where permitted.
  • (o) Social Media Information. Public profile data and information you authorize when using social login (Google, Facebook, LinkedIn) or interacting with our social pages. Purpose: authentication, profile enrichment, engagement. Basis: contract; consent via the social provider.
  • (p) Biometric Data (sensitive). Facial geometry or liveness scans used solely for identity verification in KYC flows, where offered. Purpose: verify identity, prevent fraud. Basis: explicit consent where required; legal obligation. Never sold and never used for marketing or AI training beyond the verification function. See the Illinois notice in Section 20.
  • (q) Profile and Spatial Images. Profile pictures and property imagery, including 3D or spatial captures you upload, which may incidentally depict individuals. Purpose: display listings and profiles. Basis: contract; legitimate interests. You are responsible for having rights and consents for imagery you upload.
  • (r) Inferences. Preferences and characteristics inferred from your activity, such as the property types you appear interested in. Purpose: personalization, recommendations, product development. Basis: legitimate interests. Not used to make decisions with legal or similarly significant effects (see Section 5).

We also collect information that is deidentified or aggregated. We maintain deidentified data without attempting reidentification and require the same of our vendors.

3. HOW WE COLLECT PERSONAL INFORMATION

Directly from you: account creation, web forms and chatbots, AI chat and other AI Features, listing submissions, data-room uploads, subscription and KYC flows, surveys and promotions, and your communications with us by email, phone, or video (with notice where calls are recorded).

Automatically through your use of the Platform: cookies, SDKs, pixels, log files, and similar technologies described in the Cookie Policy, capturing device data, usage, approximate location, interaction data, and AI Interaction Data.

From other sources: property owners, landlords, brokers, agents, and managers; public records and government websites; identity, KYC, sanctions, and fraud-prevention vendors; accreditation verification vendors; consumer reporting agencies where lawful and with required notices; financial data providers such as Plaid (with your authorization); payment processors; social platforms you connect; enterprise customers that invite or manage users; referrals; and data and analytics providers. When we combine information from other sources with what we already hold, this Policy governs the combined personal information.

4. HOW WE USE PERSONAL INFORMATION

Provision of the Platform: create and manage accounts, provide marketplace, listing, AI, data-room, and messaging features and requested products and services; process payments, subscriptions, investments, and distributions; respond to inquiries.

Security and Fraud Prevention: authenticate users, maintain secure sessions, detect and prevent fraud, abuse, market manipulation, prompt-injection and other attacks on AI systems, and unauthorized activity; protect the integrity of the Platform; and screen against sanctions lists. We may use tools such as Google reCAPTCHA, whose collected information is processed for security purposes.

Communications and Support: transactional and account notices, support responses, service updates, and, with your permission and applicable opt-outs, marketing communications.

Improvement and Development: testing, analytics, research, debugging, and feature development, including aggregated usage analytics and AI quality and safety evaluation as described in Sections 5 and 6.

Advertising and Marketing: first-party marketing of Hutfin services, campaign measurement, and, only if ever enabled and disclosed, interest-based advertising with the opt-outs described in Section 15. Investor suitability data (Section 2(e)) and the content of AI Inputs and Outputs are never used for advertising.

Communications Safety Review: as part of fraud, safety, market-integrity, and legal-compliance efforts, we may review, scan, or analyze user communications, AI interactions, and images on the Platform, automated where feasible and manual where necessary. We do not sell message contents and do not scan messages to send third-party marketing.

Compliance and Legal: KYC/AML/CFT, securities-law compliance and recordkeeping, tax reporting (including IRS forms), AI-transparency obligations, responding to lawful requests, enforcing our Terms and agreements, dispute resolution, and establishing or defending legal claims.

Research and Benchmarking: surveys, market research, and aggregated CRE analytics and trend reports that do not identify individuals.

Corporate and Relationship Management: vendor, partner, and enterprise account administration.

Anonymization and Aggregation: producing deidentified or aggregated datasets, which we may use and retain indefinitely without further notice, maintained in deidentified form without reidentification attempts.

5. AUTOMATED DECISION-MAKING, PROFILING, AND AI

We use automated systems, including AI and machine learning, to support the Platform: for example, AI-assisted search and listing insights, personalized recommendations, valuation analytics, fraud and anomaly detection, and eligibility screening workflows. Some activities involve profiling, meaning analysis of behavior or characteristics to make inferences (for example, the listings you view help us understand the property types you are interested in).

In limited cases, automated systems may restrict access to the Services, such as geo-blocking based on IP address or blocking sanctioned persons as required by law. Where required by law (including the GDPR and the EU AI Act), our automated decision systems are documented, explainable, and subject to human oversight. You have the right not to be subject to a decision based solely on automated processing where that decision produces legal or similarly significant effects, and you may request human review of any such decision or further explanation by contacting privacy@hutfin.com. Investment eligibility determinations that have legal effects (for example, accreditation verification) always include human review before final denial.

6. AI FEATURES: AI-SPECIFIC PRIVACY PRACTICES (hutfin.ai AND ALL AI CAPABILITIES)

6.1 Scope. This Section applies to the website and services at hutfin.ai and to every artificial intelligence, machine learning, or generative AI feature we offer anywhere on the Platform (the "AI Features"), including: AI chat and conversational assistants (such as any CRE research assistant, support chatbot, or deal-analysis copilot); AI-assisted search, matching, and recommendations; AI valuation, underwriting, comparables, and market-analytics tools; AI document summarization, extraction, translation, and question-answering over documents you upload; AI listing, content, image, and report generation; AI transcription or meeting-notes features, where offered and with notice; fraud, anomaly, market-integrity, and safety detection models; KYC, liveness, and document-authenticity models; and any beta or experimental AI capability. Anyone using hutfin.ai or an AI Feature is covered, whether or not they hold a Hutfin account.

6.2 AI Data We Collect. Inputs; Outputs; AI Interaction Data (chat and session history, feedback such as ratings or corrections, settings, regeneration and edit behavior, telemetry such as timestamps, feature used, latency, and error events); account and context data where you are signed in (so we can provide history, personalization, and support) or device and technical data where a feature is available without sign-in; and safety signals produced by automated abuse-detection systems (for example, flags for attempted fraud, prompt-injection, scraping, or prohibited content).

6.3 How We Use AI Data. We use Inputs, Outputs, and AI Interaction Data to: (a) provide, operate, and maintain the AI Features, including generating Outputs, maintaining chat history, and personalizing results; (b) secure the Platform (fraud, abuse, market manipulation, prompt-injection and jailbreak attempts, scraping, Terms violations); (c) provide support you request, including troubleshooting a specific conversation; (d) evaluate and improve quality and safety, using deidentified or aggregated data wherever feasible; (e) comply with law, including securities, AML, consumer-protection, and AI-transparency obligations, and enforce our agreements; and (f) create aggregated or deidentified analytics that do not identify you, which we may use and retain indefinitely and will not attempt to reidentify.

6.4 Model Training Commitment. We do not use your Inputs, your Outputs, or content you upload to AI Features to train or fine-tune generative AI or foundation models, whether ours or any third party's, without your prior express opt-in consent. If we ever offer an optional "help improve our AI" program, it will be off by default, clearly disclosed, and revocable at any time in account settings, and revocation will stop future training use. Deidentified and aggregated usage statistics (for example, error rates and latency) may be used to improve system performance without such consent because they do not include the content of your Inputs or Outputs.

6.5 No Advertising Use; No Sale. We do not use the content of your Inputs or Outputs for advertising, and we never use investor suitability or accreditation data or KYC files in connection with AI training or advertising under any circumstance. We do not sell Inputs, Outputs, or AI Interaction Data, and we do not share them for cross-context behavioral advertising.

6.6 Third-Party AI Model Providers and Subprocessors. Some AI Features are powered by third-party large language model and AI infrastructure providers acting as our processors or service providers. When your Inputs are processed by these providers to generate Outputs: (a) they are bound by contracts limiting their use of your data to providing the service to us; (b) they are prohibited from using your Inputs or Outputs to train their models, or we have enabled the provider's zero-retention or no-training configuration, as reflected in our agreements with them; (c) transfers to them are protected by the safeguards in Section 12; and (d) the current list of AI subprocessors, and the countries where they process data, is published and kept updated at https://dev.hutfin.com/ai-subprocessors. We also use cloud hosting, vector database, safety-classification, transcription, and analytics vendors under the vendor terms in Section 8. If a specific AI Feature routes data to a provider under materially different terms, we will say so in the feature's interface before you use it.

6.7 Human Review of AI Interactions. Limited human review of AI conversations may occur only where: (a) you ask for support on a specific interaction; (b) automated safety systems flag a conversation for suspected fraud, abuse, security attack, or legal violation; (c) review is required by law or legal process; or (d) quality evaluation is performed on samples that have been deidentified wherever feasible. Personnel with review access are limited, access is logged, and reviewers are bound by confidentiality obligations. We do not routinely read your AI conversations.

6.8 What Not to Put Into AI Features. Do not submit to AI chat or other generative AI Features: Social Security numbers or other government identifiers, full payment card or bank account numbers, passwords, health information, biometric identifiers, or other people's sensitive personal information without their consent and a lawful basis. Structured KYC, accreditation, and payment flows exist for the data that regulated processes require; AI chat is not the place for them. If you submit such data to an AI Feature anyway, we may filter, redact, or delete it, and we process any remainder under this Policy. You are responsible for having the rights and consents needed for any personal information contained in documents you upload for AI processing.

6.9 Outputs: Accuracy and Responsibility. Generative AI can produce output that is incorrect, incomplete, outdated, biased, or misleading. Outputs are informational only, are not professional advice, and must be independently verified before reliance or publication, as set out in the Terms of Service, which govern your use of Outputs. Given the nature of generative AI, Outputs provided to you may be similar to Outputs provided to other users.

6.10 Transparency and AI Labeling. We tell you when you are interacting with an AI system rather than a human, including in chat interfaces. Where AI generates or materially edits content presented on the Platform, we label it as AI-generated or AI-assisted where required by law and wherever practicable. Support channels identify when you are transferred from an AI assistant to a human agent. These practices are designed to satisfy AI-transparency obligations, including under the EU AI Act, and comparable state and national rules.

6.11 Your AI Controls. Chat history: you can view and delete individual AI conversations or your full AI chat history in account settings; deletion removes the conversation from your visible history and schedules deletion from our active systems per Section 6.12. Training opt-in: any program using your content to improve AI models is opt-in, off by default, and revocable in settings (Section 6.4). Personalization: where AI personalization can be disabled for a feature, the control appears in that feature's settings. Feature choice: AI Features are optional; core marketplace functions remain usable without engaging AI chat or generative tools, except where an AI system is a required security control (for example, fraud screening). Rights requests over AI data: Section 15 applies fully.

6.12 AI Data Retention. Signed-in chat history is retained until you delete it or your account closes, subject to the periods below. Upon deletion, content is removed from active systems within 30 days and from backups on our standard backup cycle. We retain: safety-flagged interactions for up to 2 years for fraud, abuse, and security purposes; records required for legal compliance (including securities and AML recordkeeping described in Sections 11 and 14) for their mandated periods; and deidentified or aggregated analytics indefinitely. Third-party model providers process Inputs transiently to generate Outputs and are configured for zero or minimal retention as described in Section 6.6 and at https://dev.hutfin.com/ai-subprocessors.

6.13 AI Security. AI Features are protected by the safeguards in Section 13, plus AI-specific controls: encryption of Inputs and Outputs in transit and at rest; segregation of AI logs with restricted, logged access; safety filters and abuse-detection systems; red-teaming and adversarial testing (including for prompt-injection and data-exfiltration attacks); and vendor security review of AI subprocessors. Report suspected vulnerabilities to accountsecurity@hutfin.com.

6.14 Children and AI. AI Features are not directed to children and are subject to Section 16. Users under 18 may not use AI Features that relate to investments under any circumstance.

6.15 AI and International Users. The transfer safeguards (Section 12), jurisdiction-specific notices (Section 20), and rights procedures (Section 15) apply fully to AI data. For EEA/UK users, the legal bases for AI processing are contract (providing the AI Features you use), legitimate interests (security, quality, and abuse prevention), consent (any training opt-in, and personalization where required), and legal obligation (compliance and transparency duties). Where the EU AI Act applies to a Hutfin AI system, we maintain the required transparency, documentation, human-oversight, and risk-management measures for that system's classification.

6.16 Changes Affecting AI Data. If a future change to this Policy would newly permit training on your content, it will apply only on an opt-in basis as described in Section 6.4.

7. COOKIES AND TRACKING TECHNOLOGIES

We and our partners use cookies, pixels, web beacons, SDKs, local storage, and similar technologies as described in our Cookie Policy at https://dev.hutfin.com/cookie-policy, which explains each category (strictly necessary, performance and analytics, functionality, and advertising if enabled), the providers involved (such as Google Analytics), retention, and your controls, including our cookie banner and preference center for jurisdictions requiring consent. We honor Global Privacy Control signals as described in Section 15. We do not currently respond to Do Not Track signals, for which no uniform standard exists.

8. HOW WE DISCLOSE PERSONAL INFORMATION

Affiliates and Subsidiaries: within the Hutfin corporate group for operations, compliance, support, and service delivery, consistent with this Policy.

Vendors and Service Providers: hosting, IT and security, analytics, payment processing, identity/KYC/accreditation verification, sanctions and fraud screening, communications and email delivery, customer support tools, AI model and infrastructure providers (Section 6.6), tax and accounting services, and professional advisors. Vendors are contractually bound to use personal information only to perform services for us and to protect it; vendors processing deidentified data are bound not to reidentify it.

Other Users, at Your Direction: when you inquire about a listing, request information, download documents from a property page, submit a bid or offer, or message another user, the relevant seller, broker, or counterparty receives your relevant information. Profile details, listings, reviews, and posts you make public are visible to other users and may be indexed by search engines. Do not post information you want to keep private.

Issuing Entities and Securities-Role Parties: for investment features, we disclose investor data to the applicable Issuing Entity and to any registered broker-dealer, funding portal, ATS, transfer agent, escrow agent, custodian, or auditor engaged for the offering, for subscription processing, distributions, recordkeeping, and regulatory compliance. Your underlying KYC file is not shared with other users.

Payment and Financial Partners: as described in Sections 9 and 10.

Advertising and Analytics Partners: we currently do not serve third-party display ads and do not sell personal information. We use analytics providers (such as Google Analytics) under contracts limiting their use of data. If we ever engage in "sharing" for cross-context behavioral advertising, we will update this Policy and the Cookie Policy in advance and provide the opt-outs described in Section 15 before any such sharing occurs.

Consumer Reporting and Background Check Providers: where lawful and with required notices and consents, in connection with transactions or verification.

Legal, Regulatory, and Safety: to law enforcement, regulators (including securities regulators), courts, and other authorities as reasonably necessary to comply with law, enforce our Terms, protect rights, property, and safety, or investigate fraud or abuse.

Corporate Transactions: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, during diligence and upon completion, with protections required by law.

With Your Consent or at Your Direction: for example, when you share a listing, use social features, or link third-party integrations.

Aggregated or Deidentified Data: we may share data that does not reasonably identify you.

SMS and Mobile Data: mobile phone numbers collected for text messaging, your opt-in consent records, and message contents are used only to operate our messaging programs (such as two-factor authentication and transactional or requested messages) and related customer care. We do not sell, rent, or share mobile opt-in data, text-messaging consent, or SMS phone numbers with third parties or affiliates for their own marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties except regulators or as required by law. Reply STOP to opt out and HELP for help; message and data rates may apply.

9. FINANCIAL DATA ACCESS VIA PLAID

We use Plaid Inc. ("Plaid") to enable you to securely connect your financial accounts (such as bank accounts) to the Platform.

By using this functionality, you authorize Hutfin and Plaid to access, transmit and process your financial information from your financial institution on your behalf.

The information obtained via Plaid may include, but is not limited to: account balances, transaction history, and account and institution details.

We use this information solely to provide, operate and improve our services, including financial insights, transaction related features and platform functionality. We also use Plaid connectivity to help prevent overdrafts and to prevent, detect, and mitigate fraud.

Hutfin does not store your banking credentials. Your login credentials are processed securely by Plaid.

Your use of Plaid is subject to Plaid's Privacy Policy, available at: https://plaid.com/legal/#privacy-policy

By connecting your financial account, you expressly consent to Plaid's collection, use and sharing of your data in accordance with Plaid's Privacy Policy.

10. PAYMENT PROCESSORS (STRIPE, PAYPAL, AND OTHERS)

We use third-party payment processors, which may include Stripe, Inc. and PayPal, as well as card acquirers, ACH originators, digital wallet providers, and financing partners, to process payments. These vendors collect financial information as necessary to process your payments; we do not view or store full card numbers or bank credentials. We may disclose personal information to these vendors to process transactions, prevent and investigate fraud and security incidents, manage risk, alert you to detected fraud, provide customer service, and resolve disputes. Their privacy policies apply in addition to ours (Stripe: https://stripe.com/privacy; PayPal: https://www.paypal.com/legalhub/privacy-full). For investment subscriptions and distributions, EFTs (ACH/wire) may be processed through a registered broker-dealer, escrow agent, or banking partner identified in the applicable Offering Documents, and you authorize the sharing of your identity and bank account data with those named partners to process your instructions.

11. INVESTOR AND FRACTIONAL-OWNERSHIP DATA; SECURITIES AND AML RECORDKEEPING

When you express interest in, subscribe to, or hold a Fractional Interest, we and/or the applicable Issuing Entity process the categories in Section 2(c), (d), and (e) to: verify eligibility under the securities exemption for the offering; administer subscriptions, capital accounts, distributions, and redemptions; conduct enhanced AML/BSA/OFAC screening; prepare required tax reporting (for example, K-1s or 1099s); and maintain books and records that securities regulators may require us or the Issuing Entity to produce.

Retention Carve-Out: federal and state securities law and AML law may require retention of identity-verification, suitability, and transaction records for a minimum period (commonly five to seven years following the later of the transaction or account closure), even if you request deletion. We honor deletion requests to the fullest extent the law allows and will explain any retention that cannot be waived.

No Marketing or AI Training Use: investor suitability and accreditation data is never used for marketing, advertising, or AI model training and is subject to enhanced internal access controls with access logging.

If you use the Platform only as a marketplace or listings service and decline investment features, the investor-specific processing in this Section does not apply to you.

12. INTERNATIONAL DATA TRANSFERS

We operate globally and are headquartered in the United States. Your personal information may be transferred to, stored, and processed in the United States and other countries where we, our affiliates, or our service providers (including AI subprocessors listed at https://dev.hutfin.com/ai-subprocessors) operate, which may not have data protection laws equivalent to your country's.

EU/UK/Switzerland: we rely on adequacy decisions where available and otherwise on Standard Contractual Clauses and the UK IDTA/Addendum, with supplementary measures as appropriate. UAE: transfers comply with UAE PDPL requirements (adequacy or contractual safeguards). India: DPDP Act transfer mechanisms and contractual safeguards. China: PIPL cross-border mechanisms (CAC assessment, certification, or standard contract) where applicable. Canada, Singapore, Japan, Australia, New Zealand, Brazil, South Africa, and others: transfers per applicable law using recognized safeguards or consent.

You may request information about the safeguards applied to your transfers via privacy@hutfin.com.

13. HOW WE SECURE PERSONAL INFORMATION

We use administrative, technical, physical, and organizational safeguards aligned with industry standards, including encryption in transit and at rest where appropriate, access controls and least-privilege permissions, logging and monitoring, and pseudonymization where feasible. Investor, biometric, and AI interaction data receive enhanced access restrictions as described in Sections 6.13 and 11. No system is completely secure, and we cannot guarantee absolute security; transmission of information over the Internet is at your own risk. Keep your password confidential and report any suspected compromise to accountsecurity@hutfin.com. If a breach affecting your personal information occurs, we will investigate and notify you and regulators as required by applicable law.

14. HOW WE RETAIN PERSONAL INFORMATION

We retain personal information only as long as reasonably necessary for the purposes in this Policy: while your account is active, for a reasonable period afterward, and as required for legal obligations (including securities recordkeeping of commonly five to seven years and AML recordkeeping of commonly five years after account closure), fraud prevention, dispute resolution, and enforcement of agreements. Where retention periods conflict across jurisdictions, we apply the longer period necessary to satisfy the applicable regulator and document the basis. AI data retention follows Section 6.12. Analytics data is retained per our providers' settings (for example, up to 26 months for Google Analytics). When no ongoing need exists, we delete or anonymize personal information; where deletion is not immediately possible (for example, backup archives), we securely isolate the data until deletion is possible. Deidentified and aggregated data may be retained indefinitely.

15. YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have the rights described below, in Section 20, and under other applicable laws. All rights in this Section apply equally to AI Inputs, Outputs, and Interaction Data.

Access/Know and Portability: request access to your personal information and, where feasible, a portable copy, including (where law provides) the categories collected, sources, purposes, and categories of recipients.

Correction: review and correct your information in account settings at any time, or ask us to correct inaccurate or incomplete information.

Deletion: request deletion, subject to the exceptions in Sections 6.12, 11, and 14 (securities/AML/tax retention, fraud prevention, backups, and other legal carve-outs). If exceptions apply, we will tell you which and why. AI chat history can also be deleted directly in account settings.

Objection and Restriction: object to or request restriction of certain processing, including processing based on legitimate interests, and object to direct marketing at any time.

Withdrawal of Consent: withdraw consent at any time where processing is based on consent (including any AI training opt-in), without affecting prior lawful processing. Withdrawing consent may limit features that depend on it.

Opt Out of Sale/Sharing/Targeted Advertising: we do not sell personal information. If "sharing" for cross-context behavioral advertising is ever enabled, you may opt out via account settings, the "Do Not Sell or Share My Personal Information" footer link, or a Global Privacy Control (GPC) signal, which we treat as a valid opt-out request for the browser or device sending it. We do not respond to Do Not Track signals.

Limit Use of Sensitive Personal Information: where applicable law provides this right, you may limit use of sensitive personal information to purposes permitted by law. We already limit sensitive data (KYC, financial, biometric, precise location) to service delivery, security, and compliance purposes.

Opt Out of Profiling with Significant Effects: where applicable law provides, you may opt out of profiling that produces legal or similarly significant effects; see also Section 5 (human review).

Marketing Opt-Outs: unsubscribe from marketing emails via the link in each message or by contacting us; reply STOP to end marketing texts. We may still send transactional and legally required communications. For interest-based advertising generally, you may also use industry tools at https://www.networkadvertising.org/choices and https://www.aboutads.info/choices and device settings for mobile ad IDs; these are browser- and device-specific.

Appeals: if we decline your request and you reside in a jurisdiction with an appeal right (including Virginia, Colorado, Connecticut, Oregon, Texas, Minnesota, and others), you may appeal by replying to our decision or emailing privacy@hutfin.com with the subject "Privacy Appeal." If unsatisfied, you may contact your state Attorney General or local regulator.

Non-Discrimination: we will not discriminate against you for exercising privacy rights.

How to Exercise Rights: email privacy@hutfin.com or support@hutfin.com with subject "Privacy Rights Request," use the online form at https://dev.hutfin.com/privacy-request, or write to our postal address. We will verify your identity (and, for investor records, account ownership) before acting, and may request additional information to do so; we cannot fulfill requests we cannot verify. We respond within the time required by your law (generally 45 days, extendable once with notice; 30 days where required). Authorized agents may submit requests with proof of authorization (and, where required, a valid power of attorney or our direct confirmation with you); written permission is not required for opt-out requests. There is no fee unless requests are excessive, repetitive, or manifestly unfounded.

16. CHILDREN AND TEENS

The Platform is not directed to children. We do not knowingly collect personal information from children under 13 (U.S. COPPA) and will promptly delete any such data we learn of; contact privacy@hutfin.com if you believe a child provided us data. Regional rules we honor: GDPR/UK guardian authorization under 16 (member-state variations apply); California 13 to 15 opt-in before any sale/share; UAE parental consent for children's data; India special consent rules for minors under 18; China guardian consent under 14; Japan parental consent as defined by law. No person under the age of majority may hold a Fractional Interest, regardless of parental consent, and users under 18 may not use investment-related AI Features. We do not knowingly sell or share the personal information of consumers under 16.

17. THIRD-PARTY LINKS AND FEATURES

The Platform may link to or integrate third-party websites, apps, tools, social widgets, and content that we do not own or control. Their privacy practices govern your use of their properties, and we are not responsible for them. Review their privacy notices before providing personal information.

18. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in our practices or the law. We will post updates here with a revised "Last Updated" date. For material changes, we will provide at least 30 days' advance notice by email, in-app notice, or website notice, except where a shorter period is required by law, and will request consent where law requires it. Any change that would newly permit AI training on your content applies only on an opt-in basis (Section 6.16). If you disagree with an update, you may close your account; continued use after the effective date means you accept the revised Policy.

19. ACCESSIBILITY

This Policy is designed to be readable by browser audio readers. If you are visually impaired or need this Policy in an alternative format or additional support, contact privacy@hutfin.com.

20. JURISDICTION-SPECIFIC NOTICES

UNITED STATES

State Consumer Privacy Rights. Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws have, subject to those laws: rights to access/know, correct, delete, and port personal information; to opt out of sale, targeted advertising ("sharing" in California), and certain profiling; to limit sensitive personal information use (where provided); to non-discrimination; and to appeal denials (where provided). We apply the strongest common baseline of these rights Platform-wide rather than varying by state. Residents of California, Delaware, Minnesota, and Oregon may request additional detail about recipients of their personal information. Minnesota residents may question profiling results, learn the reasons and actions that produced a decision, and request correction and re-evaluation, where the law applies.

Sales and Sharing Status. Hutfin does not sell personal information and has not sold personal information in the preceding 12 months. Hutfin does not currently "share" personal information for cross-context behavioral advertising; if that changes, we will update this Policy and provide the opt-outs in Section 15 first. Categories we have disclosed for business purposes in the preceding 12 months, and the recipient categories, are described in Sections 2, 6, and 8.

California (CCPA/CPRA) Category Mapping. In the preceding 12 months we have collected the following CCPA categories, mapped to Section 2: Identifiers (2(a), (b), (c), (o)); Cal. Civ. Code 1798.80 personal records (2(a), (c), (d), (f), (q)); Protected classifications (2(n), where volunteered); Commercial information (2(g), (d)); Biometric information (2(p)); Internet or network activity (2(i), (j), (k)); Geolocation (2(l)); Sensory/audio-visual (2(j), (m), (q)); Professional or employment information (2(f)); Inferences (2(r)); Sensitive personal information (2(c), (d), (e), (l) precise, (p)). Sources: Section 3. Purposes: Sections 4 and 6. Disclosures: Section 8. Retention: Sections 6.12 and 14. We use sensitive personal information only for purposes permitted by Cal. Civ. Code 1798.121(a) and implementing regulations (service delivery, security, verification, compliance), so the right to limit does not currently require an additional control. "Shine the Light": Hutfin does not disclose personal information to third parties for their own direct marketing purposes; California residents may nonetheless submit inquiries under Civil Code 1798.83 to privacy@hutfin.com.

Illinois (BIPA). Where biometric identifiers or information are collected in Illinois for identity verification, we first provide written notice of the purpose and retention schedule and obtain your written (electronic) consent; we store biometric data securely with restricted access; we never sell, lease, or trade biometric data; and we permanently destroy it when the verification purpose is satisfied or within the period required by BIPA, whichever occurs first. Our biometric retention and destruction schedule is available at https://dev.hutfin.com/privacy-policy.

Nevada. We do not sell covered information as defined in Chapter 603A of the Nevada Revised Statutes. Nevada residents may submit verified opt-out requests, and requests to be placed on our internal do-not-call list, to privacy@hutfin.com.

GLBA. Personal information we collect in connection with financial products or services (including investment accounts) is subject to the federal Gramm-Leach-Bliley Act. See the GLBA Appendix below, which governs that information; the state rights above may not apply to GLBA-covered data.

EEA / UNITED KINGDOM / SWITZERLAND. Hutfin is the controller of personal data described in this Policy unless otherwise stated. Legal bases are identified in Sections 2 and 6, and transfers are safeguarded as described in Section 12. You have rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent, and rights regarding automated decision-making (Section 5). Contact privacy@hutfin.com to exercise rights or to obtain a copy of transfer safeguards. You may lodge a complaint with your local supervisory authority (EEA: https://edpb.europa.eu; UK: ICO at https://ico.org.uk; Switzerland: FDPIC at https://www.edoeb.admin.ch). Our EU/UK representative details, once appointed, are published at https://dev.hutfin.com/privacy-policy.

CANADA (PIPEDA and provincial laws). We may use service providers outside Canada, including in the United States; personal information processed abroad is subject to the laws of those countries and may be accessible to their authorities. You may access and correct your personal information and make complaints by contacting privacy@hutfin.com; if unsatisfied, you may contact the Office of the Privacy Commissioner of Canada.

AUSTRALIA. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may access and correct your information and complain about our handling via privacy@hutfin.com; if unsatisfied, contact the OAIC at https://www.oaic.gov.au.

NEW ZEALAND. We handle personal information under the Privacy Act 2020 and the Information Privacy Principles. Access, correction, and complaints: privacy@hutfin.com; if unsatisfied, the Office of the Privacy Commissioner at https://www.privacy.org.nz.

UAE (PDPL) AND GCC. We provide notice and obtain consent where required, honor access, correction, deletion, restriction, objection, and portability rights under the PDPL, and will publish our UAE representative when designated. Investment features are unavailable to UAE residents unless conducted in compliance with applicable regimes.

INDIA (DPDP Act). We process digital personal data with consent or for legitimate uses recognized by the Act, honor access, correction, erasure, and grievance rights, and will publish grievance-officer contact details as required. Complaints: privacy@hutfin.com.

CHINA (PIPL). We obtain separate consent where required (including for sensitive personal information and cross-border transfers), honor access, copy, correction, deletion, and account de-registration rights, and use PIPL-recognized transfer mechanisms.

JAPAN (APPI). We handle personal information per the APPI, including purpose limitation, security controls, and rules for third-party provision and cross-border transfers, and honor disclosure, correction, and utilization-cease requests.

SINGAPORE (PDPA). We honor access and correction rights and consent withdrawal, and maintain a Data Protection Officer contact at privacy@hutfin.com.

BRAZIL (LGPD). We process personal data under LGPD legal bases and honor confirmation, access, correction, anonymization, portability, deletion, and consent-withdrawal rights. Complaints may be directed to the ANPD.

SOUTH AFRICA (POPIA). We process personal information lawfully under POPIA, honor access, correction, and deletion rights, and you may complain to the Information Regulator.

21. CONTACT US

Hutfin Global Technologies, Inc. - Privacy Office 1720 Stratton Dr, Virginia Beach, VA 23456, USA Privacy requests: privacy@hutfin.com (subject "Privacy Rights Request"; AI matters: subject "AI Privacy") Online form: https://dev.hutfin.com/privacy-request General: support@hutfin.com (Alt: director@hutfin.com) Security: accountsecurity@hutfin.com

We have designated a privacy lead to investigate and respond to privacy inquiries and monitor compliance with this Policy. Regional representatives (EU/UK, UAE, APAC), once appointed, are published at https://dev.hutfin.com/privacy-policy.

Quick Links: Terms of Service: https://dev.hutfin.com/terms. Cookie Policy: https://dev.hutfin.com/cookie-policy. Investor Disclosures: https://dev.hutfin.com/investor-disclosures. AI Subprocessors: https://dev.hutfin.com/ai-subprocessors. Copyright and DMCA Policy: https://dev.hutfin.com/copyright.

APPENDIX: U.S. GLBA CONSUMER PRIVACY NOTICE

Rev. July 2026

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include: Social Security number and income; investment experience and assets; account balances and transaction history; bank account information. When you are no longer our customer, we continue to share your information as described in this notice.

How? All financial companies need to share customers' personal information to run their everyday business. Below, we list the reasons financial companies can share their customers' personal information, the reasons Hutfin chooses to share, and whether you can limit this sharing.

Reasons we can share your personal information | Does Hutfin share? | Can you limit this sharing? For our everyday business purposes (processing transactions, maintaining accounts, responding to court orders and legal investigations, reporting to credit bureaus) | Yes | No For our marketing purposes (to offer our products and services to you) | Yes | No For joint marketing with other financial companies | No | We don't share For our affiliates' everyday business purposes (information about your transactions and experiences) | Yes | No For our affiliates' everyday business purposes (information about your creditworthiness) | No | We don't share For our affiliates to market to you | No | We don't share For nonaffiliates to market to you | No | We don't share

Questions? Email privacy@hutfin.com.

Who is providing this notice? Hutfin Global Technologies, Inc. and its affiliated companies operating investment-related services on the Platform.

How does Hutfin protect my personal information? We use security measures that comply with federal law, including computer safeguards, encryption, access controls, and secured files and facilities.

How does Hutfin collect my personal information? We collect your personal information, for example, when you: open an account; give us your contact information; connect a bank account; provide income or accreditation information; subscribe to an investment; or use our services. We also collect personal information from others, such as identity-verification vendors, financial data providers (like Plaid), affiliates, and public sources.

Why can't I limit all sharing? Federal law gives you the right to limit only: sharing for affiliates' everyday business purposes regarding creditworthiness; affiliates using your information to market to you; and sharing for nonaffiliates to market to you. State laws and individual companies may give you additional rights to limit sharing; see the state notices in Section 20.

Definitions. Affiliates: companies related by common ownership or control, including companies with a Hutfin-branded name and Issuing Entities under common control. Nonaffiliates: companies not related by common ownership or control; Hutfin does not share with nonaffiliates so they can market to you. Joint marketing: a formal agreement between nonaffiliated financial companies that together market financial products or services; Hutfin does not jointly market.

California Residents: under California law, we will not share information we collect about you with nonaffiliates except as the law allows (for example, with your consent or to service your accounts), and we limit sharing among affiliates to the extent required by California law.