Octane AI Privacy Policy

Last Updated: August 5, 2025

We at Octane AI, Inc. ("Octane AI", "we", "our", or "us") know you care about how your personal information is used and shared, and we take your privacy seriously. Octane AI operates an online service designed to enable business customers ("Customers") to better understand the product needs and preferences of their users ("End Users") in order to personalize product recommendations and email marketing to End Users (collectively, the "Services"). By using our website (http://www.octaneai.com) or by using our Services, you acknowledge that you understand the practices and policies outlined in these Privacy Policies.

• For Octane AI current or potential business Customers who use our website, refer to our Octane AI Website Privacy Policy
• For consumers or End Users of Octane AI business Customers, refer to our Octane AI Product-Platform Privacy Policy

---

Octane AI Website Privacy Policy

Table of Contents

1. Information we collect through this website
2. How we Use Personal Information
3. How we Disclose Personal Information
4. Your choices with our personal information uses
5. Cookies and Other Tracking Technologies
6. U.S. State-specific Notice
7. UK/EEA Resident Notice
8. Security
9. Retention
10. Third-Party Links
11. Changes to this policy
12. Contact

1. Information we collect through this website

Octane AI does not intend for this website or any of the Services to collect personal information (or 'personal data' for EU visitors) from children under the age of 16. If you are engaged in marketing to individuals under 16, please do not attempt to register for the Services. If you believe that information about children under 16 may have been provided to us, please contact us via email at privacy@OctaneAI.com

We collect personal information when you directly give it to us. We offer multiple ways in which you may contact us or send us your information, including when you install our app through Shopify, register for an account, send us emails, fill out forms, and occasionally through surveys. The information we may collect from you through these processes is:

• Full name
• Email address
• Phone number
• Postal address
• Business information including professional title, company name, business platform, and company URL
• Billing and administrative finance information
• Correspondence, which may include any personal information provided during an email correspondence or Customer service engagement

On occasion, we may also ask you to provide us with information about another person and their contact information, such as with other potential business users of our Services, billing contacts or others. In such an instance, we will treat the other person's information the same as yours and in accordance with this policy.

We automatically collect information about you when you interact with our website, app, emails, or on social media. Like most websites and apps, we use tools to measure your engagement activities, which may include the use of pixel tags and cookies. Finally, we send email updates and offers, and may collect information about your interaction with our emails. Specifically, we collect the following pieces of information through these interactions:

• Website visit analytics such as referral link clicks, pages viewed, and time spent on site
• IP addresses and general geographic location derived from IP addresses
• Registered Account IDs
• Cookie IDs
• Mobile Advertising IDs
• Email opens and click-throughs that will be associated with an email address

2. How we Use Personal Information

We use personal information in order to:

• Provide you with the Website and Services.
• To improve our Website and Services.
• Communicate with you through email, including product and feature promotions.
• Personalize our website.
• Customer support, including email, phone, and video conferencing.
• Incorporate your feedback, testimonials or reviews into our content, products, Website or Services. If we are interested in using any content associated with your personal information for publicity purposes, we will request your permission in advance.
• Aggregate or anonymize information about the various types of information, integrations, metadata and performance metrics to ensure our Website and Services are serving their intended purposes and for product improvements.
• For any legal purpose necessary, including IP protection, or if we are required to process information as a result of a court order or other legal or regulatory proceeding.

3. How we Disclose Personal Information

We work with business partners who provide referrals and integrate with our Services. In some cases, these partners may share personal information with us, and receive some analytics around your integration with our Services. We are not responsible for the privacy practices of these partners when you use them in conjunction with Octane AI. Partners include, but are not limited to:

• Facebook
• Shopify
• Dashbot
• Yext
• Klaviyo
• Smile.io
• Recharge
• Yotpo

We contract with service providers who use your personal information exclusively to support Octane AI, and include:

• Customer communications through Hubspot and Intercom
• Web and app analytics through Mixpanel and Google Analytics
• App and software hosting through Amazon AWS
• Online advertising through Facebook and others
• Survey tools
• Website creation and hosting

With the exception of certain third party advertising services specifically regulated by U.S. laws (see the 'Cookies' section below), we will not sell, rent or share your personal information with third parties for their own uses without your express consent. However, there are occasions we may share personal information for a designated business purpose, including:

• Protect the legal rights of our Customers, our company, our employees, our agents, and our affiliates.
• Protect the safety and security of those who access and use our Website and Services.
• Detect and protect against fraud.
• In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet law enforcement requirements or a court order, subpoena, or other judicial, administrative, or investigative proceedings.
• We may disclose personal information as part of a business transition. For example, we may disclose personal information with prospective purchasers exclusively to evaluate the proposed transaction. You will be notified via email and/or a prominent notice on our Website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

We may share aggregated information that does not identify any personal information, such as the number of website or app visits, referring partner metrics, or number of account registrations.

4. Your choices with our personal information uses

If you are a Customer, you may contact us at any time and request the following choices with our use of your personal information:

• Access. We can provide you with the personal information that we maintain about you.
• Modification. We will correct any mistakes with your personal information.
• Opt-Out. You may request that we cease using your information for marketing or other purposes that are not required to provide the Services you've requested:

- Marketing Emails: To opt out of marketing e-mail communications concerning Octane AI's Services, you may click the 'unsubscribe' link in the marketing emails.

- Tailored advertising using cookies: Refer to our list of advertising services above for company-specific choices, or visit http://optout.aboutads.info to exercise an industry-wide opt-out. In addition, you may reject or delete cookies through your browser settings.

- Tailored advertising on third party websites. You can opt out on our 'Your Privacy Choices' webpage.

• Deletion. You can request that we delete any personal information about you, unless we are required by contract or law to retain it.

You can exercise these rights by contacting us at privacy@OctaneAI.com.

5. Cookies and Other Tracking Technologies

Like many companies, we use cookies and similar technologies (such as clear gifs, web beacons, tags, and similar technologies) to collect information about your browsing activities, your interactions with our Website and Services, and to serve tailored ads and for the purposes described in this Privacy Policy. There are a number of ways to opt out of having your online activity and device data collected through these services, which we summarize below:

• Opting out of cookie use in our Cookie Preferences. You can opt out of cookies via our 'Your Privacy Choices' link. You may also opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.
• Tailored Advertising Using Your Email Address. If we have collected your email address, it may be used for tailored advertising on other websites, including through social media. To opt out of this use, please email us at privacy@OctaneAI.com.
• Advertising Industry Opt-Out Tools. You can also use these opt-out options to limit use of your information for interest-based advertising online or in apps by visiting http://optout.aboutads.info for U.S. residents, and https://www.youronlinechoices.eu/ for EU/UK residents.
• With Each of Our Vendors Individually. The following advertising or marketing services partners offer opt-out features that let you opt-out of use of your information for interest-based advertising or profiling:

Please note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

6. U.S. State-specific Notice

Some U.S. states have enacted comprehensive privacy laws. The California Consumer Privacy Act, as amended by the California Privacy Rights Act or "CPRA" (collectively, the "CCPA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Oregon Consumer Privacy Act ("OCPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Florida Digital Bill of Rights ("FDBR"), the Montana Consumer Data Privacy Act ("MTCDPA"), the Iowa Consumer Data Protection Act ("IADPA"), the Delaware Personal Data Privacy Act ("DEPDPA"), the Nebraska Data Privacy Act ("NEDPA"), the New Hampshire Privacy Act ("NHPA"), the New Jersey Data Privacy Act ("NJDPA"), the Tennessee Information Protection Act ("TNIPA"), the Minnesota Consumer Data Privacy Act ("MNCDPA"), the Maryland Online Data Privacy Act ("MDODPA"), the Indiana Consumer Data Protection Act ("INCDPA"), the Kentucky Consumer Data Protection Act ("KYCDPA"), and the Rhode Island Data Transparency and Privacy Protection Act ("RIDTPPA") create additional privacy obligations for businesses and provide their residents with additional privacy rights.

Additional Privacy Rights:

In addition to the rights granted in 'Your Privacy Choices' above, if you are a resident of the above states, you may have the right to:

• Access To Personal Information. For details about the personal information we have collected over the last twelve months, including the categories of sources, please see the 'Personal Information We Collect' section above. We collect this information for the business and commercial purposes described in the 'How We Use Your Personal Information' section above. We share this information with the categories of third parties described in the 'How We Disclose Your Personal Information' section above.
• Opt out of the 'sale' or 'share' of your personal information for targeted advertising. We do not 'sell' or 'share' your personal information for monetary benefit. However, some third party cookies placed on our Website may be considered a 'sale' or 'share' under these privacy laws. You may opt out of such cookies as detailed in 'Use Of Cookies and Tracking Technologies' section (above).

You can exercise these rights by contacting us at privacy@OctaneAI.com.

Appeal:

If we deny your privacy request, you may appeal that decision by emailing us at privacy@OctaneAI.com. We will respond to your appeal within a reasonable period of time and as required by law. If, after we have processed your appeal, you are still unsatisfied with our response, you have the right to file a complaint with your state attorney general.

Authorized Agent:

If you are an authorized agent submitting a request on behalf of another person, you must provide a copy of a lawful power of attorney or written authorization from the consumer (along with proof of your identity). If you make a request as an authorized agent, you will receive additional instructions. Depending on the type of request, we may contact you or the consumer on whose behalf you claim to act to verify your authorization.

Controller/Business and Processor/Service Provider Designation:

We operate as a Controller (and a 'Business' under CCPA) in operating our Website and in processing Customer information. We operate as a 'Processor' (and a 'Service Provider' under the CCPA) in operating our Services and in processing End User information on behalf of our Customers.

7. UK/EEA Residents Notice

Residents of the ("UK") and European Economic Area ("EEA") are provided certain privacy rights under the UK and EU General Data Protection Regulations ("GDPR").

Legal Basis:

Under the GDPR, we process Personal Data under the following legal basis.

Controller and Processor Designation:

Under the GPDR, we operate as a Controller in operating our Website and in processing Customer information. We operate as a 'Processor' in operating our Services and in processing End User information on behalf of our Customers.

Cross-Border Data Transfers:

We may transfer to, and store the data we collect about you, in countries other than the country in which the data was originally collected, including the United States, Canada or other destinations outside the EEA and the UK. Those countries may not have equivalent data protection laws as the country in which you provided the data. When we transfer your data to other countries, we will protect the data as described in this Privacy Policy and applicable supplemental product privacy policy and comply with applicable legal requirements providing adequate protection for the transfer of data to countries outside the EEA or UK.

If you are located in the EEA or UK, we will only transfer your Personal Data if:

• The country to which the Personal Data will be transferred has been granted a European Commission adequacy decision; or
• We have put in place appropriate safeguards in respect of the transfer, for example we have entered into the Standard Contractual Clauses adopted by the European Commission and required additional safeguards with the recipient, or the recipient is a party to binding corporate rules approved by a supervisory authority.

Data Protection Officer:

We have appointed a Data Privacy Officer to oversee compliance with this Privacy Policy. If you have any questions about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer at gdpr@OctaneAI.com.

Additional Rights for UK or EEA Residents:

In addition to the rights granted above, if you are a UK or EEA resident, the GDPR grants you the right to lodge a complaint against us with your local data protection authority. You can find your data protection authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

8. Security

We conduct due diligence on all our personal information service providers, and require them to have adequate security protections in place. If Octane AI processes your personal information on our own systems or servers, we will also put in place mechanisms to prevent unauthorized access or disclosures. We endeavor to protect the privacy of your account and other personal information we hold in our records, but unfortunately, we cannot guarantee complete security.

We will retain your personal information as long as we consider it relevant in order to maintain a relationship with you, or as required by law. As noted above, you can request we delete your information at any time.

9. Retention

We will retain Customer personal information only for as long as it is necessary for the purposes of fulfilling our Website and Services or otherwise as described in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

10. Third-Party Links

The Services may contain links to other websites or services. We do not exercise control over the information you provide, or is collected by these third party websites. We encourage you to read the privacy policies or statements of the other websites you visit.

11. Changes to this policy

If we change this policy, we will post an update on our home page. If the change involves something substantially different from our current policy, we will post the update in advance of the change taking place and send an email to everyone subscribed to our email updates.

12. Contact

You may reach us at privacy@OctaneAI.com or

PO Box 7775 #94590

San Francisco, CA 94120-7775

---

Octane AI Product-Platform Privacy Policy

Table of Contents

1. Information we Collect through our Services
2. How our Service Uses Personal Information
3. How our Service Discloses Personal Information
4. Your Privacy Choices
5. U.S. State-specific Notice
6. UK/EEA Residents Notice
7. Service Security
8. Retention
9. Children's Privacy
10. Changes to this policy
11. Contact

1. Information we Collect through our Services

When our Customers use our services, they may enable us to process various types of personal information from End Users of Octane AI Customers. Please note, the below list is not exhaustive of all personal information, and is intended to serve as a sample set.:

• Contact information such as name, email address, phone number, and other identity data provided by the End User.
• Personal data provided when an End User completes surveys or responds to quizzes, which may include information on habits, lifestyle preferences, product preferences and concerns, household information, health, wellness or fitness information.
• Metadata and analytics for End Users' use of our Services, including IP address, device information, date/time of visits, new or returning visits, products viewed, page response times, URL clickstreams, how long End Users stay on our pages, what End Users do on those pages.
• Inferences that may be drawn from or created based on any of the information identified above.

Our Customers may use our Services to collect personal information deemed 'sensitive' under data privacy laws, such as health information, when provided by End Users in a survey or quiz. See below for more information on exercising rights related to this information.

2. How our Service Uses Personal Information

Subject to the terms of our Customer agreements, we may use personal information for the following business purposes:

• To provide our Website and Services.
• To communicate with you.
• To improve our Website and Services.
• To send End Users email communications on our Customers behalf in accordance with written instructions.
• Aggregate or anonymize information about the various types of information, integrations, metadata and performance metrics to ensure our Website and Services are serving their intended purposes and for product improvements.
• For any legal purpose necessary, including IP protection, or if we are required to process information as a result of a court order or other legal or regulatory proceeding.

3. How our Service Discloses Personal Information

We utilize various service providers to operate our Website and Services, which includes sharing Customer and/or End User personal information for the following categories of business purposes:

• Integrations with our Service, which may include:

- E-commerce platform providers such as Shopify.

- Marketing platforms such as Klaviyo and Attentive.

In addition, we may share personal information in order to:

• Protect the legal rights of our Customers, our company, our employees, our agents, and our affiliates.
• Protect the safety and security of those who access and use our Website and Services.
• Detect and protect against fraud.
• In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet law enforcement requirements or a court order, subpoena, or other judicial, administrative, or investigative proceedings.
• We may disclose personal information as part of a business transition. For example, we may disclose personal information with prospective purchasers exclusively to evaluate the proposed transaction. You will be notified via email and/or a prominent notice on our Website of any change in our business ownership and management of your personal information.
• We may disclose de-identified, aggregate, or anonymous information for any purpose. This means that the information we disclose does not identify specific individuals, nor is combined with other data to protect your privacy.

4. Your Privacy Choices

As Octane AI is a 'processor' (and a 'service provider' under the CCPA) on behalf of our Customers, any requests to fulfill any of our Customer's End User rights to personal data should be directed to the Customer with whom you wish to make such a request. However, you may customize your browser or mobile operating system privacy settings to limit our use of pixel tags, cookies or mobile device IDs.

Alternatively, you may exercise your legally required data subject rights by emailing us at privacy@OctaneAI.com (or gdpr@OctaneAI.com for UK/EEA residents) with the specific rights request and the identified Octane AI Customer. We will direct your request to the Customer for an authorized response.

5. U.S. State-Specific Notice

Some U.S. states have enacted comprehensive privacy laws. The California Consumer Privacy Act, as amended by the California Privacy Rights Act or "CPRA" (collectively, the "CCPA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Oregon Consumer Privacy Act ("OCPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Florida Digital Bill of Rights ("FDBR"), the Montana Consumer Data Privacy Act ("MTCDPA"), the Iowa Consumer Data Protection Act ("IADPA"), the Delaware Personal Data Privacy Act ("DEPDPA"), the Nebraska Data Privacy Act ("NEDPA"), the New Hampshire Privacy Act ("NHPA"), the New Jersey Data Privacy Act ("NJDPA"), the Tennessee Information Protection Act ("TNIPA"), the Minnesota Consumer Data Privacy Act ("MNCDPA"), the Maryland Online Data Privacy Act ("MDODPA"), the Indiana Consumer Data Protection Act ("INCDPA"), the Kentucky Consumer Data Protection Act ("KYCDPA"), and the Rhode Island Data Transparency and Privacy Protection Act ("RIDTPPA") create additional privacy obligations for businesses and provide their residents with additional privacy rights.

Additional Privacy Rights:

• Opt out of the 'sale' or 'share' of your personal information for targeted advertising. We do not 'sell' or 'share' your personal information for monetary benefit, albeit some of our Services may integrate on behalf of our Customers with third party advertising services which may trigger such rights that you may exercise through that Customer's website or provided mechanism.
• Opt out of Profiling.
• Sensitive personal information. If you participate in Customer surveys or quizzes, our Customers may collect certain information that may be deemed 'sensitive' under select U.S. state privacy laws. We do not 'sell' or 'share' this information for any third party use, but you can exercise your right to delete any collected information by exercising any legal rights through that Customer's website or provided mechanism, or you may email us at the address below with the identified OctaneAI Customer and we will direct your request to that Customer.

6. UK/EEA Residents Notice

Residents of the ("UK") and European Economic Area ("EEA") are provided certain privacy rights under the UK and EU General Data Protection Regulations ("GDPR").

Legal Basis:

Under the GDPR, we process Personal Data under the following legal basis.

Cross-Border Data Transfers:

We may transfer to, and store the data we collect about you, in countries other than the country in which the data was originally collected, including the United States, Canada or other destinations outside the EEA and the UK. Those countries may not have equivalent data protection laws as the country in which you provided the data. When we transfer your data to other countries, we will protect the data as described in this Privacy Policy and applicable supplemental product privacy policy and comply with applicable legal requirements providing adequate protection for the transfer of data to countries outside the EEA or UK.

If you are located in the EEA or UK, we will only transfer your Personal Data if:

• The country to which the Personal Data will be transferred has been granted a European Commission adequacy decision; or
• We have put in place appropriate safeguards in respect of the transfer, for example we have entered into the Standard Contractual Clauses adopted by the European Commission and required additional safeguards with the recipient, or the recipient is a party to binding corporate rules approved by a supervisory authority.

Additional Rights for UK or EEA Residents:

In addition to the rights granted above, if you are a UK or EEA resident, the GDPR grants you the right to lodge a complaint against us with your local data protection authority. You can find your data protection authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

7. Service Security

We conduct due diligence on all our personal information service providers, and require them to have adequate security protections in place. If Octane AI processes your personal information on our own systems or servers, we will also put in place mechanisms to prevent unauthorized access or disclosures. We endeavor to protect the privacy of your account and other personal information we hold in our records, but unfortunately, we cannot guarantee complete security.

We will retain your personal information as long as we consider it relevant in order to maintain a relationship with you, or as required by law.

8. Retention

We will retain End User personal information only for as long as it is necessary for the purposes of fulfilling our Website and Services or otherwise as described in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. Children's Privacy

We do not intentionally process any personal information from children under the age of 16. If you believe we have obtained personal information associated with children under the age of 16, please contact us at privacy@OctaneAI.com and we will delete it.

10. Changes to this policy

If we change this policy, we will post an update on our home page. If the change involves something substantially different from our current policy, we will post the update in advance of the change taking place and send an email to everyone subscribed to our email updates.

11. Contact

You may reach us at privacy@OctaneAI.com or

PO Box 7775 #94590

San Francisco, CA 94120-7775