Datavault Product Privacy Notice

This Datavault Product Privacy Notice (the “Notice”) describes how Datavault AI Inc. and its affiliates (collectively, “Datavault,” “we,” “our,” or “us”) collect, use, and disclose personal information that is processed when you access the Datavault AI Information Data Exchange® and our other specialized exchanges that enable users to connect, sell, buy, exchange, license, tokenize, and monetize data assets and rights, including name, image, likeness, and other real-world assets; our mobile applications (each, and “App”); and any other products, platforms, or services that link to this Notice (collectively, the “Products”).

As used in this Notice, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you. Personal information also includes “personal data,” as used in certain privacy and data protection laws.

We provide additional privacy notices that apply to specific services and that may supplement this Notice.

1. Personal Information Collection

We and our vendors may obtain personal information directly from you, from our affiliated companies, automatically when you access the Product (such as through cookies, pixels, and other tracking technologies), from personal information we have created (such as if we assign you with a login or develop inferences about you), from companies we do business with (such as your employer), from service providers and vendors that help us to run our business, and from third parties (such as advertising networks, social networks, internet service providers, data analytics providers, and referrals).

Depending on the Product you use and how you interact with us, we may collect the following categories of personal information about you:

• Identifiers and Personal Records, such as name, email address, postal address, phone number, and account login credentials.
• Commercial and Financial Information, such as payment information, account balances, payment or transaction history, assets, and other records of personal property, products, or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or Other Electronic Network Activity Information, such as browsing history, IP address, device type, operating system, session duration, and other information regarding interactions with our Products.
• Geolocation Data, such as location inferred from device IP address.
• Professional or Employment Information, such as employer, occupation, and job title.
• Audio, Electronic, Visual, or Similar Information, such as audio recordings of customer service calls and photographs of your face submitted for verification. Although we may receive a copy of your photograph, such as for “liveness checks” to confirm the image was captured from a live person at the time of submission, we do not process your biometric data.
• Contents of Communications, such as when you send us an inquiry or make a complaint.
• Inferences drawn from the above categories of personal information reflecting your preferences, characteristics, behaviors, attitudes, and abilities.

If you provide personal information related to a third person through the Products, you are responsible for ensuring that you have the right and/or authority to disclose such personal information. You are responsible for notifying such third parties about the details of this Notice, as well as obtaining consent from such persons (if consent is required) or otherwise ensuring that you have sufficient legal bases to process the personal information of such third parties through the Products lawfully and in accordance with this Notice.

We may supplement personal information obtained about you with other information, as well as combine personal information obtained offline and online.

2. Personal Information Use

The categories of personal information described above may be used for the following purposes:

• Provide and operate the Products, including processing transactions you initiate; creating, administering, and supporting user accounts; authenticating users; performing technical operations, such as updating software; and providing access to and support for the Products.
• Communicate with you, including providing information about the Products; sending administrative, policy, and other business updates; and responding to your questions, complaints, or other inquiries.
• Maintain and enhance the Products, such as performing audits and data analysis; creating new products or offerings; analyzing user interactions; tracking usage patterns; and otherwise delivering, refining, and improving the Products.
• Advertise and market, such as providing targeted content, notifying you about offers or promotions, and evaluating how successful campaigns are.
• Maintain security and safeguards, such as authenticating users, preventing fraud and cyber risk, enforcing our terms, and safeguarding users and systems.
• Support business operations, such as performing accounting, recordkeeping, auditing, and legal activities; evaluating operational and business performance and risk; and maintaining compliance and business documentation.
• Comply with legal and regulatory requirements, such as responding to court orders or other mandates from government and law enforcement agencies; handling actual or potential legal actions, claims, defenses, or statements; ensuring compliance with relevant laws, regulations, legal processes, industry standards, and our internal policies; complying with anti-money laundering procedures and tax reporting requirements; preventing fraudulent, suspicious, or illegal activities; and otherwise managing risks and compliance.
• Manage business transactions, such as evaluating, negotiating, and executing actual or contemplated mergers, acquisitions, financings, sales, bankruptcies, or restructurings involving all or part of our business or assets.

If you use our identity verification Products, we may display your identity to authorized users. For example, our VerifyU App displays your photograph in your digital student identification card and your profile within the Student Web Wallet.

We may also use personal information in any other way we describe at the point of collection and for any other purpose with your consent.

Subject to applicable legal requirements, we may aggregate, anonymize, or de-identify personal information for various purposes, including development and enhancement of our Products.

3. Personal Information Disclosure

Personal information may be disclosed to the following recipients:

• Affiliates within our group of companies for the purposes outlined in this Notice (including those for which we retain service providers as described below) by transferring personal information between our affiliates or between locations as part of our global operations.
• Service providers, vendors, and professional advisors to host and operate the services, Products, and related applications; design, operate, and support Product features, including supporting user verification processes (which may involve review of your photograph for a “liveness check”); process and fulfill orders and transactions; send communications; analyze and measure Product activities and usage; support promotions and events; and perform other administrative, technical, or professional services on our behalf.
• Single sign-on providers (such as Apple, Facebook, and Google) to facilitate account creation and authentication, through which we may receive information made available by you or the provider based on your account settings.
• Advertising and marketing partners to send you information that we think may interest you; for targeted, remarketing, and customized advertising; to administer promotions and contests; and to promote other services we offer.
• Business partners (such as distributors, resellers, managed service providers, implementation partners, and training delivery partners) to communicate with you and to support Product delivery, operation, implementation, integration, resale, and training, including where such partners provide services directly to you or facilitate purchases in certain locations.
• Law enforcement, regulators, courts, other governmental authorities, and other related parties to comply with applicable legal and regulatory obligations; respond to lawful requests, such as court orders, regulatory inquiries, investigations, and enforcement actions; prevent fraud; protect our rights and property and the rights and property of others; and protect us, our employees, users of our Products, you, and others.
• Parties to business transactions to facilitate actual or contemplated business transactions, such as mergers, reorganizations, financings, sales, joint ventures, bankruptcies, restructurings, or other transfers of all or part of our business, assets, or equity, in which personal information may be transferred as part of the transaction.
• Other parties at your direction to carry out your requests, such as authorized institutions who review your identity credential as part of the credential verification process, and third parties to whom you choose to share your credentials or qualifications through the VerifyU App.

When we disclose personal information obtained through our Apps to the parties described above, we require that they provide the same level of protection for personal information as required by this Notice.

4. Cookies and Other Similar Tracking Technologies

We and our vendors may use cookies, web beacons, pixels, software development kits, and other similar technologies (collectively, “Cookies”) to collect information when you interact with the Product. Depending on how you interact with us, we and our vendors may obtain information through Cookies such as browser type, IP address (and general location data inferred from IP address), device ID, visit time, and pages visited. This information is used to save preferences, enable sign-in, analyze performance, track usage, personalize advertising, prevent fraud, and support other business functions.

Cookies vary in how long they are kept on your device. We use both Session Cookies and Persistent Cookies.

• “Session Cookies” are temporary Cookies that last for only a single browsing session. The information they collect is stored in temporary memory and erased shortly after you leave the Product or close your browser.
• “Persistent Cookies” are stored on your device until you take steps to remove the Cookies or until a particular Cookie’s expiration date (often several months after the Cookie is placed on your device). Persistent Cookies can record information from each visit you make to the Product as long as they remain on your device.

We may use third-party tools, such as Google Analytics, to understand and analyze how visitors interact with and experience the Product, including the features you engage with, how you navigate, page views, how much time is spent on a page, clicks/touches, mouse movements, scrolls and keystroke activities. For more information on how Google Analytics uses data, visit support.google.com/analytics/answer/6004245. To opt out of aggregation and analysis of data collected by Google Analytics, please visit tools.google.com/dlpage/gaoptout.

Many ad and analytics companies are part of industry groups like the Network Advertising Initiative (“NAI”) and the Digital Advertising Alliance (“DAA”), which allow you to opt out of targeted ads easily. For more information about the NAI, please visit thenai.org/how-to-opt-out from the U.S. or youronlinechoices.eu from the EU. You may also opt out of certain tracking technologies through the DAA by visiting youradchoices.com from the U.S., youradchoices.ca from Canada, and www.youronlinechoices.com from the EU.

We are not liable for how effective or accurate external parties’ opt out programs or statements are.

Depending on the browser you use, you may be able to decline or delete Cookies via browser settings. Please note that declining or deleting Cookies may impact the functionality of certain features on the Product. Additionally, if you use multiple browsers or devices, you must update the settings for each individually.

Your browser may send a “Do Not Track” signal. The Product does not respond to these signals. To learn more about “Do Not Track,” visit allaboutdnt.com.

5. External Links and Features

The Products may contain various links to, as well as plug-ins or widgets from, social media and other third-party websites or applications, which may provide additional information, goods, services, and/or promotions. These third-party websites or applications are owned and operated independently of Datavault and may have their own separate privacy and data collection practices. We are not responsible for the privacy practices of any third party. Prior to interacting with any third-party websites or applications, we recommend you review their privacy policies and practices.

6. Promotions

We may offer various promotions (“Promotions”) through the Products or elsewhere that may require registration with your personal information. If you choose to enter or otherwise participate in a Promotion, your personal information may be disclosed to third parties in connection with administration of the Promotion, such as in connection with winner selection, prize fulfillment and as otherwise required by law. By entering into a Promotion, you agree to the official rules that govern that Promotion, which may contain specific requirements, including, except where prohibited by law, allowing the sponsor and/or other parties to use your name, voice and/or likeness in advertising or marketing materials. These rules will be displayed to you during the registration process, and you will be asked for your consent to the respective data processing at that time.

7. How Long We Retain Personal Information

We retain the personal information described in this Notice for as long as necessary to fulfill the purposes for the collection or as otherwise authorized by law. Generally, personal information is retained for the duration of your relationship with us, plus any legally or contractually required record or data retention period. In addition, personal information is retained for as long as one of the following apply:

• The personal information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we collected the information;
• The personal information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the personal information was collected; or
• The personal information is reasonably required to protect or defend our rights or property and/or protect our ability to exercise those rights.

Where personal information is used for more than one purpose, we will retain it until the purpose with the latest period expires.

8. Your Choices

You may access, update, or remove certain information that you have submitted to us by sending an email to us at privacy@dvlt.ai. We may require additional information from you to allow us to confirm your identity.

To stop receiving promotional emails, follow the unsubscribe instructions provided in our emails. You may continue to receive informational communications related to our Product, such as updates about transactions conducted through our Product.

If you no longer wish to provide personal information through our App, you may uninstall it from your device. Uninstalling the App will not delete your user account or information we previously collected through the App, and it will not affect our collection of personal information through our other Products.

9. Additional Information for U.S. Residents

This section describes how we process the personal information of consumers in U.S. states with comprehensive consumer privacy laws, including California (collectively, the “Applicable States”). In the event of a conflict between any other policy, statement, or notice and this section, this section will prevail as to residents of the Applicable States (“State Resident”).

Terms defined in the Applicable State laws that are used in this section and not otherwise defined in this Notice shall have the same meaning as in the Applicable State law.

The disclosures in this section (including the disclosures made in the Notice that are incorporated into this section) apply to our current practices, as well as our activities in the twelve (12) months preceding the “Effective Date.”

a. Sensitive Personal Information

Some of the personal information we collect that is described in the “Personal Information Collection” section may be considered “sensitive” under Applicable State law, such as account login, financial account number in combination with any required security or access code, password, or credentials allowing access to an account. We collect this information for the limited purpose of providing the Products you request. We do not use or disclose sensitive personal information for purposes to which the right to limit use and disclosure applies.

b. Applicable State Privacy Rights

State Residents may have certain rights regarding how we process their personal information, depending on their state of residence and Applicable State law.

You may exercise your privacy rights by emailing us at privacy@dvlt.ai. In some cases, we may need to verify your identity or your authorized agent’s authority to submit a request on your behalf. This could require additional information from you. Requests will be handled promptly and in accordance with legal requirements.

Subject to certain exceptions, you may exercise the following rights:

• Rights to Know and Access. You may have the right to confirm whether we are processing your personal information; to access your personal information; and to obtain certain information about our processing of your personal information, including the categories of personal information we have collected about you, and the specific pieces of personal information we have collected about you.
• Right to Data Portability. You may have the right to obtain a copy of personal information you provided to us in a portable format.
• Right to Correct. You may have the right to request that we correct personal information we maintain about you that you believe is inaccurate.
• Right to Delete. You may have the right to request that we delete personal information we collected about you.

We do not sell personal information or share personal information for targeted advertising. We do not use automated decision-making tools for any purposes, including profiling, to which rights apply under Applicable States laws.

Sometimes we are unable to process requests relating to your personal information, in which case, your request will be denied. If you are a State Resident whose privacy rights request has been denied by us and you believe we denied it in error, you may appeal for reconsideration of your request by emailing privacy@dvlt.ai.

We will not discriminate against you because you choose to exercise your privacy rights.

c. California’s “Shine The Light” Law

Under California’s “Shine the Light” law, California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their direct marketing purposes in the preceding calendar year. We do not share personal information with third parties for their direct marketing purposes. If you are a California resident, you may request information about our compliance with this law by emailing us at privacy@dvlt.ai or by sending a letter to: ATTN: Privacy Inquiry, Datavault AI Inc., One Commerce Square, 2005 Market Street, Suite 2400, Philadelphia, PA 19103. Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year.

10. Additional Information for Individuals Outside the United States

This section describes how we process the personal information of individuals outside of the United States that access or otherwise use our Products. In the event of a conflict between any other policy, statement, or notice and this section, this section will prevail as to individuals outside of the United States that access or otherwise use our Products (“Data Subjects”).

Datavault AI Inc. is the controller of personal information processed pursuant to this Notice. If you have questions regarding this Notice or our privacy practices, you may contact us at privacy@dvlt.ai.

a. Lawful Basis

If applicable law requires a lawful basis for processing, we process your personal information based on the following:

• You have consented to the use of your personal information, for which you may withdraw consent at any time.
• We process your personal information to perform, or enter into, a contract or provide you with our Products, including to respond to your inquiries.
• We have a legal obligation to use your personal information.
• We have a legitimate interest in using your personal information, including to conduct business analytics, and otherwise improve the safety, security, and performance of our Products (such as implementing and enhancing security measures and protections, and protecting against fraud, spam, and abuse); maintain and improve our Products; operate the Product and develop and promote our business; or aggregate, de-identify, or anonymize personal information and subsequently use such information.

b. Data Subject Privacy Rights

You may have certain rights related to the personal information that we process about you.

You may exercise your privacy rights by emailing us at privacy@dvlt.ai. In some cases, we may need to verify your identity. This could require additional information from you. Requests will be handled promptly and in accordance with legal requirements.

If you have questions about this process, including about requests we are unable to fulfill, you may contact privacy@dvlt.ai. If you have any complaints about the processing of your personal information or our response to any rights request, we ask that you contact us; however, you also have the right to lodge a complaint with the relevant supervisory or other regulatory authority.

Subject to certain exceptions, you may exercise the following rights:

• Rights to Know and Access. You may have the right to confirm whether we process your personal information, request that we provide you with information about our processing of your personal information, and obtain access to your personal information.
• Right to Data Portability. You may have the right to ask for a copy of your personal information, including in an electronic format, and transmit such personal information to another entity under circumstances required by applicable law.
• Right to Correct. You may have the right to request that we update, complete, or correct personal information we maintain about you that you believe is out of date, incomplete, or inaccurate.
• Right to Delete. You may have the right to request that we delete, destroy, or anonymize personal information we collected about you.
• Right to Restrict Processing. You may have the right to request that we restrict the processing of your personal information.
• Right to Object to Processing. You may have the right to object to our processing of your personal information for direct marketing purposes.
• Rights related to Legitimate Interests. You may have the right to obtain information about and object to our reliance on legitimate interests as the basis for processing of your personal information.
• Right to Withdraw Consent. You have the right to withdraw your consent for processing personal information where applicable.

c. Data Transfers

Your personal information may be transferred to and processed in the United States, or in other jurisdictions which may have data protection laws and regulations that are different from the laws in the country in which you are located.

We implement appropriate legal mechanisms and other safeguards (such as the UK or European Commission’s Standard Contractual Clauses) to protect transferred personal information, and to ensure that an essentially equivalent degree of protection is applied to such personal information outside its country of origin.

11. Changes

We may update this Notice at any time, as indicated by the “Effective Date” at the top of this Notice. If we make material changes, we will provide additional notice as required by law.

12. Contact Us

For questions or comments about this Notice and/or privacy practices, contact us at privacy@dvlt.ai.