PRIVACY POLICY

H2Loop AI Inc., a Delaware corporation, having its registered office at 8 The Green 11812, Dover, DE 19901, USA (hereinafter referred to as "We", "Us", "Our", "Company", or "Hydron") operates the Hydron platform, including the website available at https://www.hydron.sh/, the Hydron CLI, and any Hydron developer extensions or integrations (collectively, the "Platform" or "Services").

This Privacy Policy informs you ("You", "Your", or "User") of our policies regarding the collection, use, and disclosure of personal data when you use our Platform, and the choices you have associated with that data. We process personal data in accordance with applicable law, including where necessary to provide the Service, comply with legal obligations, pursue our legitimate interests, or based on your consent where required. This Privacy Policy works in conjunction with our Terms of Service, which is a separate agreement governing your use of the Platform. Where there is any conflict between this Privacy Policy and the Terms of Service regarding data practices, this Privacy Policy shall govern.

Any reference to this Privacy Policy shall mean the most current version, which will be made available on the Platform from time to time. We encourage you to review it periodically. Continued use of the Platform following any updates constitutes your acceptance of the revised Privacy Policy, unless otherwise required by law.

This Privacy Policy does not apply where the Company acts as a data processor and processes personal data on behalf of customers using our commercial services. Our use of that data is governed by separate data processing agreements.

We do not knowingly collect, solicit, or process personal information from anyone under the age of 18. If you are under 18, please refrain from providing any personal information to us. If we become aware that we have inadvertently collected personal information from a person under 18 without verifiable parental consent, we will take steps to delete such information promptly.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at support@h2loop.ai so that we can take appropriate action, including deletion of that information.

This Privacy Policy is intended to inform you of how we gather and use personal data that you provide to us when using our Platform. This Privacy Policy will primarily help you understand:

• The nature of personal data we collect from you
• The manner in which your personal data is collected
• The purpose of collecting your personal data
• The manner in which your personal data is stored, used, and processed
• The data subject rights that can be exercised by you
• The process to contact the Company for any issues regarding the collection or use of your personal data or to exercise the rights described below

The Company may collect the following personal data directly from You through the Platform:

• Name
• Email address
• Phone number
• Geolocation
• IP address
• Username
• Password
• Organisation/company name and details

We do not collect sensitive personal data via the Platform or our developer tooling. In the event that sensitive personal data is required to provide Services, we will obtain your consent or provide notification to you before collection, where required by law.

When you use the Hydron developer tooling (including any extensions, CLI, or integrations) and Platform, we collect the following product-specific data:

• Prompts and queries you submit to the Platform (e.g., questions, instructions, and chat inputs)
• Telemetry and usage data, including commands executed, features used, session duration, error logs, and interaction patterns within the extension
• Uploaded files such as datasheets, schematics, and PDF documents that you voluntarily upload for hardware context indexing

The Company uses cookies and similar technologies to collect information about your use of the Platform, in accordance with applicable law. Cookies are small text files stored on your browser or device. They help us improve our site and deliver a better and more personalized service.

We use the following categories of cookies:

• Strictly necessary — essential for the Platform to function. These cannot be disabled.
• Functional — remember your preferences and settings.
• Analytical — help us understand how the Platform is used so we can improve it.

Some cookies are essential for the site to operate, and we will obtain your consent before placing non-essential cookies on your device. You may manage or disable cookies through browser settings or ad-blocking tools, or, where available, through our cookie banner/consent tool. You may also withdraw your consent to non-essential cookies at any time. However, this may affect functionality of the Platform. Data collected through cookies may include IP addresses, cookie identifiers, website activity, and information submitted through web forms.

The Company may automatically collect technical and usage data when you access the Platform, including browser type, device identifiers, operating system, language preferences, access times, pages viewed, referring URLs, and interactions with the Platform.

Log data and security-related information, including server logs, error reports, access records, and information used to monitor, detect, and prevent fraud, abuse, or unauthorised access.

Aggregated or anonymised analytics data relating to website traffic, user behaviour, feature usage, and performance metrics, collected through internal tools or third-party analytics services.

Records of communications, enquiries, support requests, and where applicable, transaction-related and payment information such as billing details, payment status, and service history.

Device and network information, including device model, unique device identifiers, mobile network information, and crash data, to ensure compatibility, security, and performance of the Platform.

Personal data voluntarily provided directly by You through the Platform, including via web forms, emails, or chat enquiry features, such as your name, phone number, email address, enquiries, feedback, or any other information You choose to share.

Information collected automatically through the use of cookies and similar technologies to collect and track information pertaining to users' interactions with the Platform. Users may adjust their browser settings to refuse cookies or to be notified when cookies are being sent; however, doing so may affect the functionality of the Platform.

Data automatically collected through your use of Hydron developer tooling (including any extensions, CLI, or integrations), including telemetry, prompts submitted, commands executed, and usage patterns, as further described in Section 4.3.

Information about you received from third parties, including service providers or analytics partners, to the extent permitted under applicable law.

We use your data to conduct our business and to provide you with the best possible Services. We will use your personal data in the following circumstances:

• To provide, operate and maintain our Services, including availability and functionality
• To authenticate your access to our Services
• To improve, develop, and personalise our Services, and to introduce new features, including for the purposes of training and fine-tuning our AI models
• To process payments, track usage for billing purposes, and maintain accurate financial records
• To provide technical support, respond to inquiries, and troubleshoot issues
• To comply with applicable laws, regulations, legal processes, and enforceable governmental requests
• To communicate with you, process your requests, respond to your queries and complaints, send service updates, security alerts, technical notices, and support messages
• To keep our Platform and systems secure and to detect, prevent, and address technical issues, security threats, fraud, or illegal activities
• To monitor and analyze performance metrics, error rates, and system reliability
• Where you have given us explicit consent to do so

We process your personal data only where we have a valid legal basis to do so under applicable laws. We will only use your personal data for the purposes for which we collected it. Please note that we may process your personal data without your knowledge or consent where required or permitted by applicable law.

We take data security seriously and employ industry best practices to safeguard your personal data. All information you provide to us will be secured using strict procedures and security features to try to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed by us. However, please remember that no method of transmission over the internet or method of electronic storage is completely secure. You should use caution when deciding what information to share with the Service.

Access to your personal data is restricted to only those individuals or systems that require it to perform their designated tasks. This minimises the risk of unauthorised access, data breaches, and misuse of information.

The Company implements industry-standard technical and organisational measures to safeguard personal data, including encryption, access management, and monitoring mechanisms. The Company's service providers are bound by contractual obligations to keep your personal data protected and use it only for providing services to us.

We may share or disclose your personal data:

• To our employees, officers, insurers, professional advisers, agents, or partners who need access to perform their designated functions, on a need-to-know basis
• To third-party Service Providers, including authentication, cloud storage, infrastructure, networking, payment processing, service monitoring, analytics, insurance or other such providers. These parties process personal data only as necessary to perform services on our behalf, consistent with our and your instructions and applicable law. Hydron operates its own AI models, and we do not share your personal data with third-party AI model providers.
• When required by law, court order, or other legal process; to establish or exercise our legal rights; or to defend against legal claims
• When we believe disclosure is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to physical safety, violations of our Terms of Service, or to protect the rights, property, or safety of the Company, its users, or others
• In connection with any merger, sale of company assets, financing, acquisition, or transfer of all or a portion of our business to another company

We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes.

Our Services may contain links or access to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any personal information to them.

We process your personal data for the purposes described in this Privacy Policy on servers located in various jurisdictions, including in the United States. While data protection laws vary by country, we apply the protections outlined in this policy to your personal data regardless of where it is processed, and we only transfer data in accordance with legally valid transfer mechanisms.

We will only retain your data for as long as necessary to fulfil the purposes for which we collected it, including satisfying any legal, accounting, or reporting requirements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity and potential risks, and any applicable legal requirements.

When personal data is no longer needed, the Company and its service providers will follow procedures to delete, erase, or anonymize it in compliance with applicable laws.

Based on the jurisdiction you are located in, you may have one or more of the following rights with respect to your personal data:

• Right to Access: You have the right to obtain confirmation as to whether or not your personal data is being processed and, if so, to access that personal data and information about how it is being processed.
• Right to Correction: You have the right to request the correction of inaccurate or incomplete personal data concerning you.
• Right to Erasure: You have the right to request the erasure of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or when you withdraw your consent.
• Right to Nominate: You have the right to nominate individuals to exercise these rights on your behalf in case of death or incapacity, to the extent permitted by applicable law.
• Right to Restriction of Processing: You have the right to request the restriction of processing of your personal data under certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your personal data under certain circumstances, such as where the processing is based on legitimate interests or for direct marketing purposes.
• Rights in Relation to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not presently make any decisions based solely on automated processing that impact your legal rights or have similarly significant effects.
• Withdrawal of Consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. Please note that exercising this right may limit your ability to use some or all of our Services.
• Right to File a Complaint: You have the right to grievance redressal or to lodge a complaint about our practices with the appropriate supervisory authority in your jurisdiction.

Please note that deletion of Your personal data or withdrawal of consent may result in the discontinuation of some or all Services and customer support. The Company may continue to communicate with you regarding existing orders, transactions, or prior enquiries, as permitted under applicable law.

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information with third parties for their own marketing or advertising purposes. If this practice changes, we will update this Privacy Policy and provide you with the right to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, or provide a different level or quality of services.
• Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information as defined under CPRA, you have the right to direct us to limit our use of such information to what is necessary to perform the Services.

If you wish to exercise any of the rights listed above with respect to this Privacy Policy or your personal data, please contact us at support@h2loop.ai. We will respond to your request without undue delay, typically within 30 days of receipt of the request, and in any event in accordance with the legally required timeframe in your jurisdiction. Where permitted under law, we may extend this period taking into account the complexity and number of requests.

No fee is required to exercise any of the rights mentioned above.

For your protection, we may only implement requests with respect to the personal data associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. If you are an authorised agent submitting a request on behalf of a California resident, please contact us with written authorisation signed by the resident. We may still require the consumer to verify their identity directly.

Notwithstanding any request for deletion or modification, where permitted under law, the Company may retain certain personal data for record-keeping purposes, to complete ongoing undertakings, or to comply with applicable legal, regulatory, or sector-specific retention obligations. Any such data subject to legal hold or mandatory retention shall not be deleted from the Company's systems.

If you have any questions, grievances, or requests regarding the processing of your personal information or our privacy practices, please contact us using the following information:

• Submission of Grievance: Submit your grievance or complaint via the email above. Please provide as much detail as possible to help us understand the nature of your concern.
• Investigation: Upon receipt of your grievance, we will promptly initiate an investigation to assess the validity of your concerns. We may request additional information from you to assist in our investigation.
• Response: We will provide you with a written response to your grievance within a reasonable timeframe, typically within 30 days, and in any event within the legally required timeframe in your jurisdiction. Our response will include the outcome of our investigation and any remedial actions taken or proposed.

This Privacy Policy is subject to modification from time to time. You must periodically review the Privacy Policy for the latest information on our privacy practices. If we decide to change our Privacy Policy, we will post those changes here with the date of change and version history so that you will always know what personal data we gather, how we might use it, and whether we will disclose it to anyone. We may also notify you via email or through a notification in the application when material changes are made to this Privacy Policy.