ETHIKAL INC. PRIVACY NOTICE

Effective Date:September 18, 2026Last Updated:September 17, 2026Supersedes:the Ethikal Advisors Privacy Policy last updated March 10, 2026 at the website ethikal.com.Scope of this Notice:Ethikal’s website atwww.ethikal.com. Ethikal does not currently offer any product or service to the public other than the website.

1. Introduction

Ethikal Inc. (“Ethikal,” “we,” “us,” or “our”) is a Texas-based software company. This Privacy Notice (“Notice”) explains how we collect, use, protect, and share personal information through our website atwww.ethikal.com(the “Site”). Our Terms of Service refer to this document as our “Privacy Policy”; both names mean this document.

The Site is informational.It describes what Ethikal does and lets you contact us if you want to. It does not provide access to any Ethikal product, and Ethikal does not offer any product or service to the public as of the Effective Date. Before we begin collecting personal information in connection with any specific product, we will update this Notice to describe that collection, in accordance with Section 20.

This Notice applies to you as a visitor to the Site, whether or not you contact us and whether or not you enter into any agreement with us.

We design our privacy practices to the standards of the EU General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Texas Data Privacy and Security Act (“TDPSA”), and other applicable privacy laws.

2. Definitions

3. Scope

This Notice applies to personal information Ethikal collects from visitors to the Site. As of the Effective Date, that is:

• the information you choose to submit if you contact us through the Site (Section 5.1);

• the website analytics and log data described in Sections 5.2 and 14; and

• anything you send us directly, such as an email (Section 5.3).

That is the whole of what Ethikal collects. This Notice does not apply to any other website, product, or service, including one linked from the Site. See Section 4.

4. Third-Party Websites

The Site may link to websites Ethikal does not own or control. We are not responsible for the content, privacy practices, or terms of any of them, and this Notice does not apply to them. If you follow a link off the Site, read that site’s own privacy notice before giving it information.

5. Information We Collect

We practice data minimization: we collect only what a given feature needs, and we do not keep personal information for longer than we need it for the purpose we collected it, subject to the retention periods and exceptions set out in Section 12.

5.1 When You Contact Us

If you contact us through the Site at the email provided here should you wish to contact us (sales@ethikal.com), we collect what you submit in that form: your name and business email address, and, if you choose to give them, your company name, job title, and anything you write in the message field.

We use what you send us only to answer you and to follow up by email on what you asked about. We do not add you to a mailing list. We store what you choose to send us in our customer relationship management system (Section 9.1). Contacting us is entirely voluntary. You can read the whole Site without contacting us.

If you would rather we did not hold what you sent, write toprivacy@ethikal.comand we will delete it, subject to Section 12.

5.2 Usage and Log Data

Such information includes device and access information (browser type, IP address, operating system, session identifiers), site usage data (pages visited, referral source, session duration), error logs and performance metrics, and cookies (Section 14). This is the ordinary web-analytics data described in Section 14, and it is collected on the Site today.

5.3 Communications Data

Information you provide when you contact us by email or otherwise with a question, and our replies to you.

6. How We Use Your Information

6.1 Operating the Site and responding to you

We use your information to answer what you asked and to follow up with you by email about it, and to operate, secure and maintain the Site and understand in aggregate how it is used.

6.2 Site Operations, Safety, Security, and Analytics

We monitor the Site to:

• find and address abuse, fraud, and policy violations;

• maintain and improve the security, stability, and performance of the Site; and

• analyze aggregated usage to improve the Site.

6.3 Legal and Regulatory Compliance

We process personal data as necessary to comply with applicable law, including responding to valid legal process, regulatory reporting (including breach notification to the Texas Attorney General under Texas Business & Commerce Code Chapter 521), and government investigations, as described further in Section 9.3.

6.4 We Do Not Run Marketing Campaigns From This Site

We do not operate a mailing list, we do not send newsletters or marketing emails, and we do not add you to any list because you contacted us. If you contact us, we reply to you by email about what you asked. That is the whole of our outreach.

6.5 What We Do Not Do

• We do not sell your personal information.

• We do not use your personal data to serve third-party advertising.

• We do not use the information you give us to train artificial-intelligence models.

7. Artificial Intelligence and the Site

No Ethikal artificial-intelligence system operates on the Site.There is no chatbot or automated assistant on the Site, and nothing you do on the Site is handled by an AI system of ours. When you contact us, a person reads what you sent and a person replies.

Nothing is decided about you automatically.We do not make automated decisions that produce legal or similarly significant effects on individuals, and we do not use automated decision-making technology (“ADMT”), as that term is defined under California law, in connection with the Site.

We do not use anything you give us through the Site to train, retrain, or fine-tune any Ethikal or third-party artificial-intelligence model.

If any of this changes, we will update this Notice before it does, in accordance with Section 20.

8. Legal Basis for Processing

Where applicable under laws such as the GDPR and the CCPA/CPRA, we rely on the following legal bases:

• Consent:for non-essential cookies and analytics on the Site (Section 14). You may withdraw consent at any time without affecting prior processing.

• Legitimate interests:answering an inquiry you sent us, operating and securing the Site, preventing fraud and abuse, and running our business responsibly, where not overridden by your rights.

• Legal obligation:processing required to comply with applicable law.

9. Sharing Your Information

9.1 Service providers

We engage third-party vendors to support our operations. They are contractually required to process your data only on our behalf, in accordance with our agreement with them, and we seek out vendors whose policies reflect our own.

For the Site, those vendors are:

• Framer— website hosting and delivery.

• PostHog— website analytics (Section 14).

• Attio— customer relationship management; receives and stores what you send us through the contact form, and our correspondence with you.

If we engage another service provider that will process personal information collected through the Site, we will update this Notice before it begins, in accordance with Section 20.

9.2 Our professional advisors

We may share personal data with our attorneys, auditors, accountants, and other professional advisors in connection with their services to us.

9.3 Legal and regulatory requirements; business transfers

We may disclose information if required by law or legal process, or to protect the rights, safety, or property of Ethikal, our users, or the public, and, where permitted, will notify affected users. In a merger, acquisition, or asset sale, personal information may transfer as part of that transaction, with notice before it becomes subject to a materially different policy.

We do not sell personal data, do not share it for cross-context behavioral advertising, and do not engage in “sharing” as defined under the CCPA/CPRA.

10. Our Role

For the personal information described in this Notice, Ethikal Inc. is thecontrollerunder the GDPR and the TDPSA, and thebusinessunder the CCPA/CPRA. That means Ethikal decides what is collected through the Site and why, and Ethikal is who you contact to exercise your rights. See Sections 15 and 19.

11. Data Security

We implement technical and organizational measures appropriate to the sensitivity of the data we process, including:

• Encryption in transit and at rest.

• Regular vulnerability assessments and penetration testing; logging and monitoring of access to systems containing personal data; incident response procedures with defined notification timelines; and vendor security reviews.

No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities in accordance with applicable law.

12. Data Retention

We keep each category of personal information only for as long as we need it for the purpose we collected it, and then delete it or render it no longer attributable to you. The following applies to the Site, which as of the Effective Date is the whole of what Ethikal operates.

• What you send us through the Site (Section 5.1).Retained for 24 months from our last exchange with you, or until you ask us to remove you, whichever comes first. Thereafter we keep it only for so long as necessary to comply with our legal, tax, and audit obligations, or to establish, exercise, or defend legal claims.

• Usage and log data (Section 5.2).Analytics data collected with your consent is retained by our analytics provider for no longer than 12 months from collection, after which it is deleted or aggregated so that it is no longer attributable to a browser or a device. Server, error, and performance logs generated in delivering the Site are retained for no longer than 90 days, except where a specific log is preserved to investigate a security or abuse incident, in which case it is kept only until that investigation closes.

• Communications data (Section 5.3).Correspondence you send us, and our replies to it, are retained for 24 months from the last message in the exchange, and thereafter only as described in the first bullet above.

• Privacy-rights request records (Section 15).When you exercise a privacy right, we keep a record of the request, the identity check we performed, our decision, and how we fulfilled it. We do this because applicable law requires us to be able to demonstrate how we responded. We keep these records for 24 months from the date the request is closed, or longer where a specific legal requirement or an unresolved appeal so requires.

• Opt-out records.When you ask us not to contact you, we keep a record of that request and of the email address it applies to for as long as we operate the Site. That record is how we make sure we do not contact you again, and we do not use it for any other purpose. We keep it even if you also ask us to delete your other information: this is because deleting it would defeat the request.

• Back-up media and legally required retention.We may nevertheless retain (i) data held in routine encrypted back-up or disaster-recovery media, which is not actively processed, until it is overwritten in the ordinary course; and (ii) data we are required to retain under applicable law or a binding order, litigation hold, or regulatory direction, for as long as that requirement is in effect.

If we begin collecting a category of personal information that this section does not cover, we will state the retention period for it, or the criteria we use to determine that period, in this Notice before that collection begins, in accordance with Section 20.

You may request deletion of your personal data at any time, subject to our legal retention obligations. See Section 15.

13. Age Requirement

The Site is directed to businesses and to people acting in a business capacity. It is not directed to children, and you must be at least 18 years old to use it, consistent with our Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe we have, write toprivacy@ethikal.comand we will delete it.

14. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Site and to understand, in aggregate, how it is used. We do not use third-party advertising trackers, and we do not use cookies to build profiles of individual visitors across other websites.

• Strictly necessary cookies:required to deliver and secure the Site. These cannot be disabled.

• Analytics cookies:set by our analytics provider, PostHog, to measure page views, referral sources, and how visitors move through the Site. These are set only with your consent and can be declined or withdrawn at any time through the cookie controls on the Site.

• More about the PostHog analytics cookies.Where you consent to analytics cookies, PostHog assigns your browser an identifier and collects information about your interactions with the Site, including pages visited, referring pages, links and buttons selected, session timing, browser and device characteristics, and usage and performance information. PostHog stores a visitor identifier and session information in a first-party cookie named ph_[token]_posthog, and stores related analytics information — including that identifier, device and session identifiers, and PostHog configuration information — in your browser’s local storage. The cookie expires after 365 days. PostHog also processes your IP address.We do not use PostHog to associate this information with your name, email address, or any other information that directly identifies you.You may decline or withdraw consent to analytics cookies at any time through the cookie controls on the Site. See Section 18.

• Session replay.We do not use session replay: we do not record your mouse movements, scrolling, clicks, or what you type on the Site.

Analytics cookies are set only after you accept them. Until you do, we set only the strictly necessary cookies described above. You can change your choice at any time through the cookie controls on the Site.

We honor Global Privacy Control (“GPC”) signals as a valid opt-out request under the CCPA/CPRA, the TDPSA, and other applicable state laws that require recognition of universal opt-out mechanisms, even though we do not sell or share personal data as those terms are defined.

15. Your Privacy Rights

What you can ask for.Depending on where you live, you have some or all of the following rights. To exercise any of them, write to**privacy@ethikal.com**.

• To know what we have.The categories of personal information we have collected about you, where we got it, why we collected it, how long we keep it, the categories of third parties we disclosed it to, and the specific pieces of information we hold.

• To have it deleted.

• To have it corrected, if it is inaccurate.

• To get a copyin a portable form.

• To opt out of sale or sharing.Ethikal does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of — but you may ask us to confirm that at any time.

• To limit the use of sensitive personal information.Ethikal does not collect sensitive personal information (Section 16), so this right has nothing to operate on here.

• To object to or restrict processing, and to withdraw consent you previously gave, without affecting processing that already happened.

• Rights relating to automated decision-making.Ethikal does not make automated decisions about you through the Site (Section 7).

These rights come from the GDPR, the CCPA/CPRA, the TDPSA, and other applicable state privacy laws. Which ones apply to you depends on where you live.

How we verify who you are.Before we act on a request about specific information, we have to be reasonably sure the request is yours. Usually that means matching what you tell us against what we already hold — typically the email address you gave us — and corresponding with you at that address. For a request to know the specific pieces of information we hold, we apply a higher standard and may ask for more. We use what you give us for verification only, and we delete it afterward unless the law requires us to keep a record of the request (Section 12).

Someone acting for you.You may use an authorized agent to make a request on your behalf. We will ask the agent for written permission signed by you, and we may ask you to confirm directly with us that you gave that permission and to verify your own identity, unless the agent provides a valid power of attorney. This does not apply where the law says otherwise.

We will not treat you differently for asking.Exercising any of these rights costs you nothing, and we will not deny you anything, charge you a different price, or give you a lesser level of service because you exercised them.

How long we take.We respond within the period the applicable law allows — generally one month, extendable, under the GDPR, and 45 days, extendable, under the CCPA/CPRA and the TDPSA. We will tell you if we need an extension and why.

Appealing a decision.If we decline to act on your request, we will tell you why within the applicable response period, and you may appeal by writing toprivacy@ethikal.comwith “Privacy Request Appeal” in the subject line. We will respond in writing within 60 days of receipt, and if we deny the appeal we will give you a way to contact the Texas Attorney General to submit a complaint. Residents of other states with an appeal right may use the same type of process.

One way to reach us is enough.Ethikal operates only online and deals with you directly, so an email toprivacy@ethikal.comis the way to make any request under this Section.

16. Sensitive Personal Data

As of the Effective Date, Ethikal does not collect sensitive personal data. The Site collects only what Sections 5.1 through 5.3 describe, none of which is sensitive personal information under the CCPA/CPRA or the TDPSA, or a special category of personal data under Article 9 of the GDPR. We do not knowingly collect neural data, which the CCPA/CPRA classifies as sensitive personal information, and we do not collect biometric information.

Because we do not collect or use sensitive personal information, we do not offer a “Limit the Use of My Sensitive Personal Information” link, and none is required. If that ever changes, we will say so in this Notice, and identify the purpose and the retention period, before the collection begins, in accordance with Section 20.

17. International Data Transfers

Ethikal operates in the United States, and the Site and its service providers process data in the United States. If you access the Site from outside the United States, your information will be transferred to and processed in the United States, where privacy laws differ from those in your country.

Where a service provider named in Section 9.1 processes personal information outside the country you are in, our agreement with that provider relies on the European Commission’s standard contractual clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, as applicable.

18. Your Privacy Choices

• Email:We do not send marketing email, so there is no list to leave. If you would rather we did not email you at all, write toprivacy@ethikal.comand we will note it.

• Cookies:Decline or withdraw consent to analytics cookies at any time through the cookie controls on the Site. See Section 14.

• Everything else:To ask us to delete, correct, or give you a copy of what we hold, see Section 15.

19. Data Privacy Officer: Contact

Questions about our processing of personal data, or requests to exercise your rights, can be sent toprivacy@ethikal.com.

20. Changes to This Notice

We may update this Notice to reflect changes in our practices, technology, legal requirements, or other operational reasons. Changes take effect when we post the updated Notice on the Site. We update the “Last Updated” date whenever we change this Notice, whether or not the change is material, and we record material changes in the version history at the end of this Notice. We review this Notice at least once every 12 months.

Before we collect anything new.Where a change means we begin collecting a category of personal information that this Notice does not describe, or using what we already hold for a new purpose, we will post the updated Notice describing that collection or use before that collection or use begins.

21. Status of This Notice

This Notice is a disclosure about how Ethikal handles personal information. It is not a contract, and it does not create contractual rights or obligations. Any agreement between you and Ethikal is in our Terms of Service.

Your rights under a privacy law are governed by that law. Ethikal is a Texas company, and to the extent any question about this Notice itself is governed by state law rather than by an applicable privacy statute, Texas law applies, without regard to conflict-of-law principles.

Appendix A — CCPA/CPRA Required Disclosures

Categories of personal information collected in the preceding 12 months, the sources they came from, why we collect them, how long we keep them, and the categories of third parties we disclose them to:

We do not collect telephone numbers through the Site. We have not sold, and have not shared for cross-context behavioral advertising, any personal information in the preceding 12 months. We do not collect sensitive personal information (Section 16).

Appendix B — Contact Information