Plan and procedure

Privacy Policy is a critical part of protecting the business and our customers. As a part of keeping the privacy policy upto date with the latest law and data governance, the following review and notification process is followed at Avaamo:

Note: All the clauses as listed in the Privacy Policy section of this document shall be reviewed by the Security Governance Team.

• Avaamo’s Privacy policy shall be reviewed at least once annually by the Security Governance Team.

• Any changes to the current privacy policy are carefully discussed, reviewed, and approved by the Security Governance Team.

• After approvals, the corresponding clauses as listed in the Privacy Policy section of this document are updated for internal reference.

• For external reference, the same clauses are also updated on the Privacy policy page of Avaamo’s public website.

Notification

• Any major updates to the privacy policy are notified to all the users in a timely manner via email, including changes in the use of personal information, to meet the user’s objectives related to privacy.

• In case of any privacy policy breach, Avaamo shall take prompt actions and notify all the users in a timely manner about the breach as per the Avaamo Security Incident Response Plan.

• Avaamo shall notify the users when access is denied, when users are denied access to their PI, Avaamo shall inform them of the denial and the reasons for the denial in a timely manner, unless prohibited by law or regulation.

Privacy policy

Avaamo respects the privacy of every individual who visits www.Avaamo.ai (“Website”) and/or purchases its Services. This Privacy Statement is our commitment to transparency in communicating how Avaamo collects, uses, and discloses the information that is collected from you, the visitor of its website and/or customer as well as the choices you have with respect to the information.

Avaamo complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. Avaamo has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

What this notice covers

This Privacy Statement applies to the processing of Personal Data collected by us when you:

• Visit our websites that display or link to this Website Privacy Statement

• Visit our branded social media pages

• Receive communications from us, including emails, phone calls, or texts

• Use our products and services

• Register for, attend, and/or otherwise take part in our events, webinars or contests

Personal data collected

Customers

Avaamo may ask for your account information which includes your name, business name, email address, physical address, phone number, credit card and bank account information (stored directly with a third party processor), and website domain. By voluntarily providing Avaamo with your account information, you represent that you own and consent to our use of such personal data.

Course previewers

Avaamo may ask for your name, email address, and phone number for you to preview courses for evaluation purposes.

Website visitors

At your option, Avaamo collects information such as web server logs, internet protocol (IP) addresses, browser type, or other information as part of aggregated data.

Cookies and other tracking technologies

Avaamo uses cookies, beacons, tags, and other tracking technologies to gather demographic information about you, identify your visits to our Website, and other interactions with our Website. We gather information such as internet protocol (IP) addresses, internet service provider (ISP), operating system, browser type, and date/time stamp, and store it in log files. To collect this information, a cookie may be set on your computer or device when you visit our Website. In some countries, including those in the European Economic Area (“EEA”), the information in this paragraph may be considered personal information under applicable data protection laws.

You can control how websites use cookies by changing your cookie settings, but your modification may limit your use and functionality of some of the features on our Website.

Personal data shared

Avaamo may share the information it collects about you in the following ways:

• Third-Party Providers – Avaamo may share your information with third-party providers that provide services on our behalf. These companies may assist with marketing support, processing credit card payments, content delivery, email, providing sales leads, and customer support. Third-party providers may only process personal information pursuant to Avaamo’s instructions.

• Aggregated or De-identified Data – We may disclose or use aggregated or de-identified information with third-party providers for research purposes relating to our Services.

• As Required by Law or Similar Investigations – To comply with legal obligations (e.g. subpoena) or investigate potential legal violations. Avaamo may be required to share personal data in response to lawful requests from public authorities including to meet national security and/or law enforcement requirements.

• In case of Business Transfer: Data may be transferred to the parent company in case of any merger or acquisition.

• Safety – We may disclose your information to protect and defend the safety of Avaamo in connection with investigating and preventing fraud or security issues.

• Consent – Avaamo may share your information with your consent.

Your choices

You may unsubscribe from receiving promotional or marketing emails from Avaamo at any time by using the “unsubscribe” link in the email received, or by emailing us at privacy@avaamo.com. As outlined in the Section, Cookies and other Tracking Technologies, you can also control your cookie settings.

With respect to your account information, you may update, correct or delete information that you provided to us by logging into your Avaamo account or contacting us at privacy@avaamo.com.

Data subject rights

For individuals in the EEA, Avaamo’s legal basis for collecting and using your personal information will depend on the personal information collected and the specific context in which we collect it. Avaamo will process personal information from you where, a) we have your consent to do so, b) where processing is necessary for Avaamo to perform Services pursuant to an agreement, or c) where processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information, or may otherwise need the personal information to protect your vital interests or those of another person. At any time, you have the right to withdraw or decline consent. If you do not provide the requested information, Avaamo will not be able to perform Services for you. Also, you have the right to object where we rely on our legitimate interests to process your personal information.

Individuals located in the EEA may have additional statutory rights available to them with respect to their personal information, including the right to access your personal information, have it erased, have it corrected, or object to or restrict processing. If you would like to make such a request, please email privacy@avaamo.com and we will respond within thirty (30) days. Avaamo will need to verify that the individual is inquiring about his/her own information before we can assist with the request.

Transfers of personal data

Your Personal Data will be collected, transferred to, and stored by us in the United States or by our affiliates in other countries where we operate. In the event that your Personal Data is processed outside the European Economic Area (EEA), we will ensure that the recipient of your Personal Data offers an adequate level of protection by entering into an agreement to abide by Standard Contractual Clauses for the transfer of data as approved by the European Commission (Art. 46 GDPR), or another mechanism approved by the EU.

In the context of an onward transfer, Avaamo has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. Avaamo shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless Avaamo proves that it is not responsible for the event giving rise to the damage.

Data security and retention

Your Personal Data is kept secure. Only authorized employees, agents, and contractors (who have agreed to keep information secure and confidential) have access to this information.

We (and our third-party service providers) use a variety of industry-standard security measures to prevent unauthorized access, use, or disclosure of your Personal Data. These security measures consist of but are not limited to data encryption, physical security, access controls, network security & incident response. No method of transmission or method of electronic storage over the internet is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Avaamo will retain your Personal Data for the period necessary to fulfill the purposes outlined in this Website Privacy Statement or until you request its deletion unless a longer retention period is required by applicable data privacy law.

We take reasonable steps to ensure that your Personal Data is accurate, complete, current, and otherwise reliable for its intended use.

If Avaamo obtains knowledge that one of our service providers or employees is in violation of this Website Privacy Statement, Avaamo will take commercially reasonable steps to prevent the unauthorized use or disclosure of your Personal Data. Avaamo takes data privacy seriously.

Therefore, we agree to take commercially reasonable measures to ensure the proper handling of your Personal Data by our employees and service providers.

Children

Our Website is not intended for persons under the age of 16. Thus, we do not intentionally gather Personal Data from visitors who are under the age of 16. If you are under the age of 16, please do not submit your Personal Data via our submission forms.

California Consumer Protection Act

This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or “CCPA.”

We do not provide services, or other items of value, as consideration for your, or your end users, personal information protected by the CCPA.

You are responsible for ensuring your compliance with the requirements of the CCPA in your use of the services we provide to you and your own processing of personal information.

Here are a few things that Avaamo will NOT do with personal information in the scope of acting as a service provider, as defined by CCPA:

• sell, rent, or otherwise disclose your personal information to third parties in exchange for money or something else of value

• use your information outside the scope of the agreement(s) for services that we have with you

Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this personal information), to delete their personal information, to opt-out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights.

California consumers may make a request pursuant to their rights under the CCPA by contacting us at privacy@avaamo.com. We will verify your request using the information associated with your account, including your email address. Consumers can also designate an authorized agent to exercise these rights on their behalf.

SMS communications

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent—this information will not be shared with any third parties.

Privacy notice & AI data consent

By clicking “Start Conversation” [or “Get Started”], you agree to our Privacy Policy and consent to the processing of your data by our AI Agent under the following conditions:

• Data Collection & Context: We collect and store your inputs, prompts, and the agent’s generated outputs to maintain conversation history and provide the requested service.

• Third-Party Processing: Your queries are securely transmitted via API to third-party LLM providers (e.g., OpenAI, Anthropic, Google) for real-time processing.

• Data Minimization & Safety: Do not input highly sensitive personal data, financial information, or health records. We utilize PII masking filters to protect your identity, but absolute data isolation cannot be guaranteed within the chat interface.

• Training Opt-Out: Your data is processed via commercial enterprise APIs. We do not sell your information, nor do we use your conversation history to train secondary public AI models.

You may request the deletion of your conversation history at any time by contacting our Data Privacy Officer at privacy@avaamo.com

Changes to privacy statement

Avaamo reserves the right to modify this Privacy Statement at any time, however, should we change the Privacy Statement in a material way, a notice will be posted on our website along with the updated Privacy Statement. If you disagree with the changes, you may terminate your Services.

The Privacy Statement was last updated on May 29, 2026.

Inquiries and dispute – contacting Avaamo

• In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Avaamo commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

• In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Avaamo commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, should first contact Avaamo at:

• If you have any questions about the Privacy Policy and our data practices, please contact Avaamo at privacy@avaamo.com.

• All the requests to privacy@avaamo.com will be appropriately routed to support@avaamo.com which follows the complete cycle of change management process as applicable in the ISMS policy.

• The Federal Trade Commission has jurisdiction over Avaamo’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF.

• Avaamo will arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to your organization and following the procedures and subject to conditions set forth in Annex I of Principles.