Privacy Agreement

1Introduction

higgins.ai Incorporated and SolutionAgents (collectively referred to as "higgins.ai," "we," "us," or "our") are committed to protecting your privacy with the same rigor we apply to our AI research and engineering. This Privacy Agreement ("Agreement") governs how we collect, use, store, protect, and — critically — do not share your personal information, conversations, data, and metadata when you interact with any higgins.ai product, platform, service, agent, or application (collectively, the "Services").

We wrote this Agreement to be read — not to obscure what we do behind legal complexity. Where technical or legal language is necessary, we explain it plainly. Where we make a commitment, we make it binding.

By accessing or using the Services, you agree to this Agreement. If you do not agree, you should discontinue use immediately and may request deletion of any data we hold about you at privacy@higgins.ai.

2Our Privacy Philosophy

Privacy at higgins.ai is not a compliance checkbox. It is a design principle and a cultural value rooted in the following beliefs:

• Privacy is a fundamental human right. Every person deserves control over information about themselves, including how they think, communicate, and work. We build our products to honor that right, not to exploit it.
• You are not the product. higgins.ai's business model is built on delivering exceptional AI-powered products and services — not on monetizing your personal data, conversations, or behavioral signals. We have deliberately structured our business so that your data has no commercial value to us beyond enabling your experience.
• Minimum necessary collection. We collect only what we need to operate and improve the Services. We ask why we need each data element before we decide to collect it, not after.
• Security by design. Privacy protections and security controls are built into our architecture from the ground up — not bolted on as an afterthought.
• Radical transparency. We tell you what we collect, why, how long we keep it, and what your rights are. We notify you when legally permitted. We fight overbroad government requests on your behalf.
• Your control, your data. You can access, correct, export, and delete your data at any time. We make it easy to exercise these rights and we respond promptly.

3Who This Agreement Applies To

This Agreement applies to:

• Individual users who create a higgins.ai account and use the Services directly
• Enterprise and organizational customers and their authorized users (see also Section 12)
• Developers who access our APIs, SDKs, or developer tools
• Visitors to our websites and marketing properties who do not have an account
• Prospective customers engaging with our sales or support teams

This Agreement applies globally. Where local law requires additional or different protections, we comply with those requirements. Jurisdiction-specific terms are described in Section 20.

4Information We Collect

We collect information in three ways: information you give us directly, information generated as you use the Services, and limited technical information from your device and connection. We explain each category fully below.

4.1 Information You Provide Directly

Account & Identity Information

• Full name, email address, and password when you register
• Organizational role, title, and company name
• Profile photo or avatar (optional)
• Billing and payment information (processed by our PCI-DSS compliant payment processor; we do not store full card details)
• Communications you send to us, including support requests, feedback, and correspondence

Workspace Content

• Documents, files, spreadsheets, and knowledge assets you upload to the platform
• Forms, reports, tasks, goals, and structured data you create
• Notes, annotations, and comments you add
• Any content you choose to share with collaborators within the platform

Profile & Preferences

• Language, timezone, and display preferences
• Notification settings and communication preferences
• Configured integrations and connected third-party services (at your direction)

4.2 Information Generated Through Your Use of the Services

Conversations & AI Interactions. This is the most sensitive category of data we handle, and we treat it accordingly.

• Every message, prompt, query, and instruction you send to higgins.ai AI agents and assistants
• Every response generated by those agents
• Conversation history, thread structure, and session context
• AI agent configurations you create or modify
• Workflow inputs and outputs generated through automated processes you initiate

Metadata

• Timestamps of interactions, file uploads, and account events
• Session identifiers and authentication tokens
• Feature usage patterns (which tools you access and when)
• Interaction sequences within the platform
• Search queries within your workspace
• API call logs for developer access

Task, Calendar & Workflow Data

• To-do items, priorities, and completion records
• Calendar blocks and scheduling data
• Weekly goals, milestones, and focus objectives
• Dashboard configurations and widget states

Usage & Performance Data

• Features accessed and frequency of use
• Session start/end times and duration
• Navigation paths within the platform
• Load times and performance metrics for your sessions
• Error and crash reports linked to your session (to diagnose technical issues)

4.3 Technical Information We Collect Automatically

Device & Browser Information

• Device type, operating system, and version
• Browser type and version
• Screen resolution (for rendering optimization)
• Installed language and locale settings

Network & Connection Information

• IP address (used for security, fraud prevention, and approximate geographic region)
• Internet service provider (for network diagnostics)
• Connection type (Wi-Fi, cellular)

Security & Fraud Prevention Signals

• Login attempts and authentication events
• Anomalous activity patterns used for threat detection
• Device fingerprinting attributes used to identify unauthorized access

We collect this technical data because it is necessary to keep your account secure and the Services functioning. We do not use it for profiling beyond security purposes.

4.4 Information We Do Not Collect

To be explicit about the boundaries:

• We do not collect the content of communications outside our platform (e.g., your email, messages on other apps)
• We do not use your microphone, camera, or location without your explicit, real-time consent for a specific feature
• We do not collect information about websites you visit outside of higgins.ai
• We do not purchase or import data about you from data brokers or third-party sources
• We do not infer sensitive attributes (race, religion, health, political views, sexual orientation) from your data

5How We Use Your Information

We use your information only for the following specific purposes:

5.1 Delivering and Operating the Services

Your data is the raw material of your experience. We use it to:

• Authenticate your identity and maintain the security of your account
• Operate your workspace, AI agents, tasks, calendar, and documents
• Personalize the interface and AI responses to your context and preferences
• Enable collaboration features you choose to use
• Process transactions and manage your subscription

5.2 Improving the Services

We improve our products using data in privacy-preserving ways:

• Aggregated, de-identified analysis of feature usage patterns
• Error and crash reports to fix bugs and improve reliability
• Performance telemetry to optimize speed and responsiveness
• Research into AI model quality using only data that has been de-identified and, for enterprise customers, explicitly opted into under separate data processing agreements

5.3 Communicating with You

• Responding to your support requests and questions
• Sending service-critical notifications (security alerts, service disruptions, policy changes)
• Sending product updates, newsletters, and marketing communications only if you have opted in
• Requesting feedback about your experience

You may opt out of non-essential communications at any time through your account settings or by following the unsubscribe instructions in any message.

5.4 Security, Safety & Fraud Prevention

• Detecting, investigating, and preventing unauthorized access, fraud, and abuse
• Protecting the integrity and availability of the Services
• Verifying your identity when required for account recovery or sensitive changes
• Complying with our legal obligations related to security and data protection

5.5 Legal Compliance

We process data to meet legal obligations — including tax, financial reporting, and responding to valid legal process — only to the minimum extent required. See Section 7 for our detailed policy on government and law enforcement requests.

5.6 What We Will Never Use Your Data For

• Serving you advertisements or behavioral advertising of any kind
• Profiling you for sale to, or use by, third parties
• Evaluating or scoring you for credit, employment, insurance, or any other purpose beyond your use of our Services
• Training AI models for any purpose that could expose your content to another user
• Any purpose not listed above

6Our Absolute Commitment — We Do Not Share or Sell Your Data

This section is the center of gravity of this entire Agreement. Read it carefully.

6.1 The Commitment

This is not qualified. It does not have a carve-out for "trusted partners" or "anonymized" derivatives that could be re-identified. It applies across all business units, all products, and all jurisdictions in which we operate.

6.2 What This Covers

This commitment applies to every category of data we hold about you:

6.3 Internal Access Controls

Access to your data within higgins.ai is governed by:

• Strict role-based access controls — only employees whose job function requires access to a category of data may access it
• Audit logging — all internal access to user data is logged and subject to periodic review
• Data minimization in tooling — internal tools are designed to expose only the data necessary to perform a specific function
• Employee training & agreements — all employees with any data access sign binding confidentiality agreements and receive privacy training

6.4 The Only Time Data Leaves Our Control

There are exactly two circumstances under which your data may be processed by parties other than higgins.ai:

Circumstance 1: Service providers acting strictly on our behalf. We use a small number of vetted third-party service providers to operate our infrastructure (e.g., cloud hosting, payment processing, security monitoring). These providers:

• Act exclusively as data processors under our instruction — they have no independent right to use your data
• Are bound by contractual data processing agreements that prohibit them from using your data for any purpose beyond performing services for us
• Are selected based on demonstrated commitment to security and privacy
• Are prohibited from sub-processing your data without our prior written consent

Circumstance 2: Legally compelled disclosure. As described in full in Section 7.

No other circumstance. Not a merger, not a partnership, not a research collaboration, not a commercial agreement. Those scenarios are addressed in Section 6.5.

6.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your data would only be transferred to the acquiring entity under the following conditions:

• The acquiring entity agrees in writing to be bound by this Agreement or an equivalent or stronger privacy commitment
• You are notified of the transaction and given the opportunity to delete your data before transfer
• The transferred data is limited to what is necessary for continuity of Services

We will never sell your data as an asset independent of the business.

7Government & Law Enforcement Requests

This section reflects our strongest possible commitment to defending your privacy against external compulsion. It draws from the most protective practices in the industry.

7.1 Our Default Position

We do not voluntarily cooperate with government or law enforcement requests for user data. Any request — regardless of the jurisdiction, agency, or stated urgency — that does not meet the standards described below will be denied.

We evaluate every request against a single standard: is this a valid legal obligation we cannot lawfully refuse? If the answer is not clearly yes, our answer is no.

7.2 What We Require Before Disclosing Any Data

Before we will disclose any user data to any government or law enforcement body, we require all of the following:

• A valid, binding legal order — such as a court order, subpoena, search warrant, or equivalent instrument issued under the law of a jurisdiction with authority over higgins.ai
• Specificity — the request must identify specific users, accounts, or data — we will not comply with bulk or dragnet requests
• Proportionality — the data requested must be proportionate to the stated legal purpose
• Proper legal process — the request must have been issued through the correct legal channel with appropriate judicial or administrative oversight

We do not comply with informal requests, voluntary information sharing programs, or requests based solely on national security letters without judicial review.

7.3 What We Do When We Receive a Request

Upon receiving any government or law enforcement request for user data, we:

• Log the request — recording the requesting agency, jurisdiction, legal instrument cited, data categories requested, and date received
• Conduct a legal review — our legal team reviews every request for validity, scope, and lawfulness
• Challenge overbroad or unlawful requests — we contest requests we believe exceed lawful authority, are insufficiently specific, or are disproportionate to the stated purpose
• Notify you — we notify affected users as promptly as possible, unless we are legally prohibited from doing so (e.g., by a non-disclosure order). Where notification is prohibited, we seek to have that prohibition lifted at the earliest lawful opportunity
• Disclose the minimum — if we are compelled to disclose after exhausting challenges, we provide only the specific data explicitly required by the legal order — nothing more
• Record the disclosure — we document every legally compelled disclosure in our internal records and, to the extent permitted, in our transparency reporting

7.4 No Backdoors

7.5 National Security Requests

To the fullest extent permitted by law, we will:

• Publish aggregate statistics about national security requests received in our transparency reporting
• Challenge gag orders and non-disclosure requirements associated with national security requests
• Notify users when legally permitted to do so following the lifting of any non-disclosure requirement
• Report on the existence of national security legal processes even where we cannot provide specifics

7.6 Transparency Reporting

We will publish a Transparency Report at minimum annually, disclosing:

• Total number of government and law enforcement requests received, by category and jurisdiction
• Percentage of requests complied with, partially complied with, or denied
• Range of users affected
• Number of requests successfully challenged or narrowed
• Number of requests subject to non-disclosure orders

Until our first report is published, you may request our current disclosure statistics at any time by writing to privacy@higgins.ai.

7.7 Emergency Disclosures

In a genuine emergency involving imminent risk of death or serious physical injury — and only in such cases — we may share limited information with law enforcement without a formal legal order. This is a narrow exception used only where:

• We have a good-faith belief that the emergency is genuine and imminent
• The information we share is limited strictly to what may prevent harm
• We document the disclosure and report it in our transparency reporting
• We notify the affected user at the earliest lawful opportunity

8AI, Machine Learning & Model Training

AI is at the core of what higgins.ai does. We apply privacy-specific design principles to how our AI systems work.

8.1 How We Use AI and What Data It Touches

Our AI agents and assistants process your conversations, tasks, documents, and workspace context to generate responses and perform actions on your behalf. This processing:

• Occurs within our secure infrastructure and that of the model providers we route to as processors under contract
• Is governed by the same access controls as all other data
• Does not expose your data to other users or external parties

8.2 AI Model Training

We draw a clear distinction between:

• Model inference — using a trained model to generate a response to your input. Your data is always used for inference to serve you.
• Model training — using data to improve the underlying AI models.

With respect to training:

• We do not use your conversations, documents, or personal data to train models that are shared across our customer base without your explicit, informed, opt-in consent
• We do not use your data to train models that are licensed to or shared with third parties
• Where we conduct internal research to improve our Services, we do so using de-identified, aggregated data
• Enterprise customers may negotiate additional contractual commitments regarding training data use

8.3 Automated Decision-Making

We do not make automated decisions that have legal or similarly significant effects on you without human review. Where our AI systems produce outputs that influence decisions in your work, you retain full control and accountability for acting on those outputs.

9Data Storage, Security & Infrastructure

9.1 Where Your Data Is Stored

Your data is stored in secure, enterprise-grade data centers operated by our vetted infrastructure providers. Data is logically isolated by customer — your data is never commingled with another customer's data in a way that could allow cross-customer access.

Enterprise customers may select specific geographic regions for data residency. Please refer to your enterprise agreement for details.

9.2 Encryption

9.3 Access Controls

• Principle of least privilege — every system and employee has access only to the minimum data required for their specific function
• Multi-factor authentication — required for all internal access to production systems
• Privileged access management — elevated access to sensitive systems requires additional approval and generates audit records
• Separation of duties — no single individual can independently access, modify, and approve changes to sensitive data

9.4 Security Monitoring & Testing

• Continuous automated monitoring for unauthorized access and anomalous activity
• Third-party penetration testing conducted at minimum annually and after significant product changes
• Vulnerability disclosure program allowing security researchers to report issues responsibly
• Incident response plan with documented procedures and tested playbooks
• Bug bounty program for external security researchers

9.5 Data Breach Response

In the event of a confirmed data breach affecting your personal data, we commit to:

• Notifying affected users within 72 hours of confirmation (or earlier, as required by applicable law)
• Notifying relevant data protection authorities within legally required timeframes
• Providing clear information about what data was affected, likely consequences, and steps we are taking
• Providing guidance on steps you can take to protect yourself
• Publishing a post-incident report detailing how the breach occurred and what we have changed

10Data Retention & Deletion

10.1 How Long We Keep Your Data

We retain your data for as long as:

• Your account is active, or
• It is needed to provide the Services, or
• We are required to retain it by law

The following table describes our standard retention periods:

10.2 Deleting Your Account & Data

You may request full deletion of your account and all associated data at any time:

• Through your account settings (Settings → Profile → Delete account)
• By emailing privacy@higgins.ai with the subject line DATA DELETION REQUEST

Upon receiving a verified deletion request:

• Personal data and account information: deleted within 30 days
• Conversations, documents, and workspace content: deleted within 30 days
• Backup copies: purged within 90 days
• Billing records: retained only as required by law, isolated from your profile

We will confirm deletion in writing when complete.

10.3 Legal Holds

In rare circumstances, we may be required by law to preserve specific data beyond our standard retention periods (for example, in response to litigation holds or regulatory investigations). Where this occurs:

• The hold applies only to the specific data and the specific legal purpose
• It does not affect data outside the scope of the hold
• We delete the held data promptly when the legal obligation is resolved

10.4 De-identified Data

After deletion of your personal data, we may retain aggregate, de-identified statistics that cannot reasonably be used to identify you (e.g., "X% of users completed this workflow type"). This de-identified data cannot be reversed to reconstruct your personal information.

11Your Privacy Rights & Controls

We recognize privacy rights globally, not just where local law requires. Every user, regardless of location, may exercise the following rights:

11.1 Your Rights

• Right to Access. You have the right to request a copy of the personal data we hold about you, including what categories of data we have, why we have it, and how long we keep it.
• Right to Correction. If any information we hold about you is inaccurate or incomplete, you have the right to request correction. You may correct most information directly in your account settings.
• Right to Deletion ("Right to be Forgotten"). You have the right to request that we delete your personal data. See Section 10.2 for details on how to exercise this right and what to expect.
• Right to Data Portability. You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV), and to transfer it to another service provider of your choice.
• Right to Object. You have the right to object to our processing of your personal data in specific circumstances — for example, where we rely on legitimate interests as our legal basis for processing.
• Right to Restriction of Processing. You may request that we restrict processing of your data in certain circumstances — for example, while you contest the accuracy of the data or a decision we have made.
• Right to Withdraw Consent. Where we process your data based on your consent (e.g., optional marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right Not to Be Discriminated Against. We will not deny you Services, charge you different prices, or provide you a different quality of service because you exercised any privacy right.

11.2 How to Exercise Your Rights

• Account settings — access and correction can be done directly in Settings
• Email — send all rights requests to privacy@higgins.ai
• Response time — we respond to all verified requests within 30 days at no charge to you
• Verification — we will verify your identity before acting on a request to protect against unauthorized access

11.3 Privacy Controls Available in Your Account

Your export covers everything we hold for your account, not only your conversations: your profile and profile documents, your knowledge files, your conversations and messages across chat, the assistant, reports and forms, your form submissions, your tasks and scheduled blocks, your goals, your calendar events, your connected accounts, the actions the assistant has taken on your workspace, and your usage history. It lists the files we store for you by name so you can identify them; the file contents themselves remain available to download in the app. If any category of your data is too large to include in full, the export says so in its manifest rather than silently omitting it — write to privacy@higgins.ai and we will supply the remainder.

12Enterprise & Business Customers

When higgins.ai provides Services to an organization ("Enterprise Customer"), the relationship between higgins.ai and the enterprise's individual users is governed both by this Agreement and by the separate Enterprise Agreement or Data Processing Agreement (DPA) between higgins.ai and the organization.

12.1 Data Controller and Processor Roles

In enterprise deployments:

• The Enterprise Customer is typically the data controller — they determine the purposes and means of processing their users' data within the platform
• higgins.ai acts as a data processor — we process data only as instructed by the Enterprise Customer, subject to our own legal obligations

12.2 Enterprise Data Processing Agreements

Our Enterprise DPA includes:

• Subject matter, duration, nature, and purpose of processing
• Categories of personal data and categories of data subjects
• Obligations and rights of the controller
• Data processing instructions and permissible sub-processors
• Security obligations appropriate to enterprise risk profiles
• Audit rights for the Enterprise Customer

12.3 Sub-Processors

We maintain a list of authorized sub-processors — the limited third-party service providers that may process customer data on our behalf. These currently include our cloud hosting, database, application delivery, authentication, and AI model-routing providers. We will notify Enterprise Customers of any intended change to this list with at least 30 days' notice, giving them the opportunity to object.

You may request the current, itemised sub-processor list at any time by writing to privacy@higgins.ai.

12.4 Regulatory Compliance for Enterprise

Our enterprise infrastructure and DPA are designed to support customer compliance with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). We operate to these requirements today.

13Children's Privacy

Our Services are not directed to children under the age of 13 (or 16 in jurisdictions where that is the applicable age threshold, including the European Union). We do not knowingly collect personal information from children below the applicable age threshold.

If we learn that we have inadvertently collected personal information from a child, we will:

• Delete the information as promptly as possible
• Notify the parent or guardian if contact information is available
• Review how the data was collected to prevent recurrence

If you believe a child has provided us with personal information, please contact privacy@higgins.ai immediately.

For educational institution customers deploying higgins.ai in contexts where minors may use the Services, please contact us to execute a Children's Data Addendum reflecting the requirements of COPPA, FERPA, and applicable local law.

14International Data Transfers

higgins.ai operates globally. If you are located outside the United States, your data may be transferred to and processed in the United States or other countries where we or our vetted sub-processors operate infrastructure.

We ensure that all international transfers of personal data are protected by appropriate safeguards:

For transfers from the European Economic Area (EEA), United Kingdom, and Switzerland:

• We rely on the European Commission's Standard Contractual Clauses (SCCs) as our primary transfer mechanism
• We conduct Transfer Impact Assessments (TIAs) to evaluate the risk of transfers to specific destinations
• Where SCCs are insufficient based on our TIA, we apply additional safeguards including enhanced encryption and access restrictions

For transfers involving the United Kingdom:

• We use the UK International Data Transfer Agreement (IDTA) or UK addendum to EU SCCs

For transfers from other jurisdictions:

• We comply with applicable local data transfer requirements
• We apply equivalent privacy protections regardless of where processing occurs

You may request a copy of the transfer mechanisms applicable to your data by contacting privacy@higgins.ai.

15Third-Party Integrations

higgins.ai integrates with third-party services at your explicit direction. We treat these integrations with the same care we apply to all data handling.

15.1 How Integrations Work

When you connect a third-party service (for example, a calendar system or productivity tool):

• You explicitly authorize the connection
• We request only the minimum permissions required for the integration to function
• Data flows only in the direction and for the purpose you specified
• You can revoke any integration at any time from Settings → Connected apps

15.2 Third-Party Privacy Practices

Third-party services connected to higgins.ai are governed by their own privacy policies. We are not responsible for the privacy practices of third-party providers, and we encourage you to review their policies before authorizing an integration. We vet integration partners for baseline security compliance before making them available in the platform.

15.3 What Happens When You Revoke an Integration

When you revoke an integration, we immediately stop requesting data from that service and delete the cached data we hold from it. We do not control data that has already been transferred to the third-party service prior to revocation — you will need to contact that service directly to request deletion of previously transferred data.

15.4 Connected Calendar Accounts (Google, Microsoft, Apple)

Where you choose to connect a calendar account, higgins.ai reads your calendar so that it can schedule your work around commitments you already have. This connection is always optional, always initiated by you, and always revocable.

Microsoft and Apple calendar data is handled to the identical standard. Where a connection requires a credential rather than a revocable authorization token (Apple iCloud uses an app-specific password), that credential is encrypted before storage and is used solely to read your calendar.

16Cookies & Tracking Technologies

16.1 What We Use and Why

We use cookies and similar technologies (including local storage and session tokens) strictly for operational purposes:

16.2 What We Do Not Use

• Advertising cookies — we have no advertising infrastructure and use no ad-serving cookies
• Cross-site tracking — we do not track your activity on other websites or apps
• Third-party analytics platforms that receive identified user data — where we use analytics tools, we configure them in privacy-preserving, first-party modes

16.3 Managing Your Cookie Preferences

• Browser controls — most browsers allow you to block or delete cookies through their settings. Note that blocking strictly necessary cookies will prevent you from using the Services.
• In-product controls — Settings → Privacy → Cookie preferences lets you switch the Functional and Analytics categories on or off for yourself. Strictly Necessary and Security are not listed as switches there, because as stated in Section 16.1 they cannot be disabled without breaking the Services or your account security. Turning Functional off also clears the preferences we had already stored on your device.
• Do Not Track (DNT) and Global Privacy Control (GPC) — we honor Do Not Track and Global Privacy Control signals from browsers. When either is enabled, we disable all non-essential analytics for your sessions automatically, whether or not you are signed in, and the Analytics switch in Settings → Privacy shows as off with that reason given. This is not something you need to opt into, and it cannot be overridden from within your account.

17Transparency & Accountability

17.1 Transparency Reporting

We will publish an annual Transparency Report disclosing:

• Government and law enforcement data requests received, by type and jurisdiction
• Compliance and denial rates for such requests
• Number of users affected
• National security process statistics (to the fullest extent legally permitted)
• Privacy-related incidents and breach notifications
• Our major privacy investments and improvements during the year

Until the first report is published, these statistics are available on request at privacy@higgins.ai. See also Section 7.6.

17.2 Privacy Governance

Our privacy program is governed by:

• A designated privacy owner with authority to enforce privacy standards across the business
• A privacy review of new products and features before launch
• Privacy Impact Assessments (PIAs) for any new data collection, processing activity, or significant change to existing practices
• Privacy training for all employees
• Regular review of internal data access and usage

17.3 External Accountability

• Independent security testing — our systems are penetration tested by third parties at minimum annually, and we operate a bug bounty and vulnerability disclosure program for external researchers
• Certification in progress — we have built to the requirements of SOC 2 Type II and ISO 27001 and are pursuing formal independent audit against both. We will state on this page when each is awarded rather than implying it in advance
• Data Protection Authority registration — we register with relevant data protection authorities in jurisdictions that require it
• Privacy by Design — new features undergo privacy design review before development begins

18Changes to This Agreement

We will notify you of material changes to this Agreement at least 30 days before they take effect through:

• Prominent in-product notice when you log in
• Email notification to your registered address
• A clear summary of what changed and the reason for the change
• A comparison between the previous and new versions

Non-material changes (such as corrections of typographical errors or reorganization of content without substantive effect) may be made without advance notice, but the updated Agreement will always be available at higgins.ai/privacy with an updated "Last Updated" date.

If you disagree with a material change, you may close your account and request deletion of your data before the change takes effect. Continued use of the Services after the effective date of a change constitutes acceptance of the revised Agreement.

We retain previous versions of this Agreement. To request the version in force on a particular date, write to privacy@higgins.ai.

19Contact, Grievances & Dispute Resolution

19.1 Privacy Contact

higgins.ai Privacy Team — privacy@higgins.ai Subject line guidance:

• General privacy inquiry: PRIVACY INQUIRY
• Rights request: PRIVACY RIGHTS REQUEST
• Data deletion: DATA DELETION REQUEST
• Urgent security/privacy matter: URGENT PRIVACY MATTER
• Government request (if you are an attorney or law enforcement): LAW ENFORCEMENT REQUEST

Response times:

• Standard requests: within 30 days
• Urgent matters: within 24 hours
• Initial acknowledgment of any request: within 5 business days

19.2 Grievances

If you are not satisfied with our response to a privacy inquiry or rights request, you may:

• Request escalation to our privacy owner by adding ESCALATION to your subject line
• Lodge a complaint with your local data protection authority (for EEA residents, this is typically the supervisory authority in your country of residence)
• Seek judicial remedy in a court of competent jurisdiction

We commit to cooperating fully with data protection authorities and to implementing any remedies or decisions they direct.

19.3 Governing Law

This Agreement is governed by the laws of the jurisdiction in which higgins.ai Incorporated is incorporated, without regard to its conflict-of-law provisions. Where applicable law requires that disputes be resolved before a specific authority or court, those requirements take precedence.

20Jurisdiction-Specific Addenda

20.1 European Economic Area & United Kingdom (GDPR / UK GDPR)

Legal Basis for Processing. Under GDPR and UK GDPR, we process your personal data on the following legal bases:

• Contract performance — processing necessary to deliver the Services you have subscribed to
• Legitimate interests — security monitoring, fraud prevention, and aggregate analytics, balanced against your privacy rights
• Legal obligation — processing required to comply with applicable law
• Consent — marketing communications and optional analytics (which you may withdraw at any time)

Your EEA/UK Rights. In addition to the rights in Section 11, you have the right to lodge a complaint with your national data protection supervisory authority, and to request information about the safeguards governing international transfers of your data.

20.2 California (CCPA / CPRA)

Your California Rights. California residents have the following additional rights under the CCPA/CPRA:

• Right to know what personal information we collect, use, disclose, and sell (we sell none)
• Right to delete personal information (see Section 10.2)
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information — we do not sell or share personal information, so this right is not applicable, but it is honored by our practice
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your rights

To exercise your California rights, contact privacy@higgins.ai with the subject line CALIFORNIA PRIVACY REQUEST.

20.3 Other U.S. State Privacy Laws

We extend the rights described in Section 11 to residents of all U.S. states, including those with dedicated privacy legislation (including but not limited to Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and Florida). Contact privacy@higgins.ai to exercise any state privacy right.

20.4 Canada (PIPEDA / Law 25)

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25. Canadian users have the right to access and correct their personal information, and to challenge our compliance with applicable Canadian privacy law by contacting privacy@higgins.ai.

20.5 Australia (Privacy Act 1988)

Australian users have rights under the Australian Privacy Act 1988 and the Australian Privacy Principles. If you are dissatisfied with our handling of a complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

20.6 Brazil (LGPD)

Brazilian users have rights under the Lei Geral de Proteção de Dados (LGPD), including rights of access, correction, deletion, portability, and information about sharing. Contact privacy@higgins.ai to exercise any LGPD right.

AAppendix A — Definitions