CIRCLES LLC PRIVACY POLICY

Effective Date: March 29, 2026

CIRCLES LLC ("Company," "we," "our," or "us") respects your privacy and is committed to protecting personal information. This Privacy Policy describes how we collect, use, disclose, and otherwise process personal information in connection with our website and related interactions.

1. Scope of This Policy

Some data protection laws in various jurisdictions distinguish between "controllers" and "processors" of personal information. While other jurisdictions may use different terminology, the concept typically remains the same. A controller is the party who decides why and how to process personal information. A processor only processes information on behalf of a controller based on the controller's instruction; the processor does not make decisions about personal information.

This Privacy Policy applies to personal information that we collect and process in our capacity as a data controller and explains how we collect, use, and share such information for our own purposes. For example, this Privacy Statement covers when you:

• Visit our website that links to this Privacy Statement
• Interact with us as a representative of a company that has (or is considering) a business relationship with us (e.g., you are our customer or our supplier)
• In connection with account registration and administration
• Register for or attend a Company marketing, learning, or training event or webinar
• Provide us with feedback about our products or services
• Receive a sales or marketing communication from us, including emails, texts, or telephone calls

This Privacy Policy does not apply to information that we process on behalf of our customers within our software as a service platform. Such processing is governed exclusively by applicable customer agreements and is outside the scope of this Privacy Policy.

2. How We Collect and Use Personal Information

We collect and use personal information for various reasons. When we do so, we will use it in accordance with applicable laws.

Some jurisdictions, including the European Economic Area ("EEA"), the United Kingdom ("UK"), and Switzerland, require a legal basis, or reason, why Company is legally allowed to collect and use your personal information.

Below, we describe (1) information that may be provided by you, (2) information that may be collected automatically, (3) the categories of information we collect in those instances, and (4) our purposes and legal bases for collection. If we need to collect other personal information from you, we will explain which information we need and why at the time we collect it.

How We Collect Personal Information

Sometimes, we may ask you to provide personal information voluntarily: for example, we may ask you to provide your contact details to create an account with us, to subscribe to marketing communications from us, and to submit inquiries to us. In some cases, we combine the information you provide.

• When you request information from us. When you fill out a contact form or otherwise contact us to express interest in obtaining information about Company or our services, we may ask you to provide us with your contact information such as name, business email, telephone number, company name, job level, functional role, and address.
• If you are our customer or prospective customer. If you are a representative of a company that has (or is exploring) a business relationship with Company, we collect your business contact information including your name, business email, telephone number, and company name. If you contact us for support related to your organization's use of our products, services, or events, we will also collect information about the reason for your inquiry and other information you choose to provide to us.
• If you are our supplier. If you are a representative of a company that provides us with products or services, we collect your business contact information including your name, business email, telephone number, and company name.
• If you register for events and webinars. When you register for an event or webinar, we may ask you to provide us with your contact information such as your name, business email, telephone number, and company name; your health and safety information such as your emergency contact and your dietary preferences; and your billing information such as your billing name, billing address, and credit card number.
• If you participate in a sales call, online meeting or product demo with us. We may record sales phone calls and online meetings (including audio and video content where applicable) for training, quality assurance, and administration purposes. This includes analyzing the content of such calls and online meetings using AI-powered tools to gain better insights into our interactions with our customers and prospects. We will always notify you before a call will be recorded and will obtain your consent where required by law. We also collect information about your interaction with product demos (such as demos you access, share, and view with others) to understand your product interests and provide you with more relevant information.

We also collect certain information related to your use of our websites. In some jurisdictions in the United States and countries in the EEA, the UK, and Switzerland, this information may be considered personal data under applicable data protection laws. We may combine this information with personal information provided by you. In particular, we collect the following personal information from you automatically:

• When you access our websites or content. When you visit our websites, we collect information about your device and your usage. The information collected may include your IP address, device type, unique device identification numbers, browser type, broad geographic location (for example, country or city-level location based on your public IP address), performance, and other usage and technical information. We also collect information about how you interact with our websites (for example, referring web page, pages visited, features used), emails, content, or other features (for example, when you open a marketing email or click on an embedded link, or if you watch videos on our site, or interact with/message using our chat function). Some of this information may be collected using cookies and similar tracking technology, as further explained in the section "Cookies and Tracking Technologies" below. We do not collect "sensitive personal information" as the term is defined by California law beyond what is necessary to provide your requested services. Accordingly, we do not provide a mechanism for you to request that we limit our use of sensitive personal information.

Categories of Personal Information

We collect the following categories of personal information:

a. Identifiers

• Email address
• Online identifiers (e.g., IP address, account identifiers)

b. Internet or Network Activity Information

• Device type, operating system, and browser type
• Log data, including access times, pages viewed, and referring URLs
• Interactions with our website

c. Commercial or Professional Information

• Company name
• Job title or role (if provided)
• Business contact details submitted through forms

d. Communications Information

• Content of messages submitted through contact forms, email, or support channels
• Records of correspondence

e. Inferences

• Information derived from usage patterns to improve functionality, security, and user experience

Purposes and Legal Bases for Collecting Personal Information

We use personal information for the following purposes:

a. To Provide and Operate Our Website and Accounts

• Create and manage user accounts
• Authenticate users and maintain system integrity

b. To Communicate With You

• Respond to inquiries and requests
• Provide support and administrative communications
• Send service-related notifications

c. To Improve and Develop Our Offerings

• Analyze usage trends and performance
• Develop, maintain, and improve functionality

d. For Security and Fraud Prevention

• Monitor for suspicious or unauthorized activity
• Protect the security and integrity of our systems

e. For Legal and Compliance Purposes

• Comply with applicable laws, regulations, and legal processes
• Enforce our rights and protect against liability

Where required by applicable law (such as GDPR), we process personal information on the following legal bases:

• Performance of a contract
• Legitimate interests (e.g., security, service improvement, communications)
• Compliance with legal obligations
• Consent, where applicable

3. How We Share or Disclose Your Personal Information

We may share or disclose personal information in the following circumstances:

• Company affiliates. We may disclose any of the categories of personal information described above to affiliates within the Company group where necessary to fulfill a request you have submitted or for customer support, marketing, technical operations, event registration, and account management purposes.
• Service providers. We may disclose the categories of personal information described above to third-party service providers or vendors contracted to provide services on our behalf (for example, IT and hosting, data analytics, event services, customer support, call recording, chatbot technology, data enrichment, email fulfillment, and payment services). These third-party service providers may use personal information we provide to them only as instructed by Company.
• Event sponsors. When you participate in webinars, events, and other activities where we collaborate with third parties, we may disclose the information described under "if you register for events and webinars" above, such as your contact information and interests in these offerings or services to these approved third parties to communicate with you.
• Company Partners. We may share your personal information with certain partners that offer supplementary services to those provided by Company, such as partners that resell Company services, to the extent you consent to such sharing (where required by applicable law) or direct us to intentionally interact with such third parties.
• Your organization. Where your organization is a customer or potential customer of ours, we may disclose your personal information to relevant people within your organization. For example, we may share a list of individuals attending a Company event, information about Company Training courses you have completed, or inquiries from end users that should be addressed directly by the organization rather than us.
• Advertising. When you visit our website, we may enable third parties to use cookies and other trackers to show you ads on third-party websites that are more relevant to you. Under some data protection laws, our disclosure of this information to third parties through cookies and other trackers for targeted advertising may be considered a "sale" or "share" of personal information. Please see our Cookie Notice for more information about the types of cookies we use or click "Cookie Preferences" (link located in the footer of our Website) to set your preferences and opt-out of the sale or sharing (for targeted advertising) of your data. Company does not have actual knowledge that it "sells" or "shares" the personal information of individuals under 16 years of age.
• Additional disclosures: We may disclose data if we have a good-faith belief that such action is necessary to (a) conform to legal requirements or comply with legal processes; (b) protect and defend our rights or property; (c) enforce our website Terms and Conditions; and (d) act to protect the interests of our customers, users, or others. If Company goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of our assets, your personal information may be among the assets transferred, provided that we inform the actual or potential buyer (or its agents and advisors) that it must use your personal information only for the purposes disclosed in this Privacy Statement. We may also ask for your consent to disclose your information to other unaffiliated third parties that are not described elsewhere in this statement.

4. No Sale or Sharing of Personal Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, except as may occur through cookies and similar technologies as described in Section 12.

5. AI and Automated Processing

We may use automated technologies, including artificial intelligence and machine learning systems, in connection with our website and related services.

In this context:

• Personal information may be processed by automated systems to support functionality, security, analytics, and user experience improvements;
• We may engage third-party service providers to support such functionality, including providers of AI or machine learning technologies;
• Automated processing is used to enhance efficiency and performance, but significant decisions are not made solely by automated means in a manner that produces legal or similarly significant effects on individuals.

We implement appropriate measures designed to manage risks associated with automated processing, including safeguards related to security, reliability, and appropriate use.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including:

• The duration of an active account or relationship;
• As necessary to provide our website and related services;
• As required to comply with legal obligations, resolve disputes, and enforce agreements.

When personal information is no longer required, we will delete, anonymize, or otherwise securely dispose of it, unless retention is required or permitted by law.

7. Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction.

These measures may include:

• Encryption of data at rest and in transit where appropriate;
• Access controls and authentication mechanisms;
• Monitoring and logging of system activity;
• Security testing and vulnerability management processes.

We maintain policies and procedures designed to ensure appropriate access controls and data protection practices. However, the security of information transmitted through the internet can never be guaranteed. You are responsible for maintaining the security of your password or other forms of authentication involved in accessing password-protected or secured resources.

8. U.S. Privacy Rights

Depending on your state of residence, you may have certain rights under applicable privacy laws, including the right to:

• Know the categories of personal information we collect, use, and disclose;
• Access specific pieces of personal information;
• Request deletion of personal information;
• Request correction of inaccurate personal information;
• Opt out of the sale or sharing of personal information (note: we do not sell or share personal information);
• Limit the use of sensitive personal information (where applicable).

You may exercise your rights by contacting us as described below. We will respond in accordance with applicable law.

We will not discriminate against you for exercising your rights.

9. International Data Transfers

We may process personal information in countries other than your country of residence.

Where required by applicable law, we implement appropriate safeguards to protect your privacy, your fundamental rights and freedoms, and the ability to exercise your rights. For example, if we transfer personal information from the EEA, the UK, or Switzerland to another country such as the United States, we will implement an appropriate data transfer solution such as entering into "standard contractual clauses" approved by the European Commission or competent governmental authority (as applicable) with the data importer.

10. Your privacy rights.

Depending on where you are located and how you interact with us, you may have certain legal rights over the personal information we hold about you, subject to local privacy laws.

These may include the right, depending on your jurisdiction, to:

Obtain access to your personal information that is being processed by us.

• Correct inaccurate personal information.
• Request the deletion of your personal information.
• Opt out of the sale or sharing of personal information for targeted advertising.
• Object to the processing of your personal information carried out on the basis of our legitimate interests in the EEA, UK, and Switzerland, and ask us to restrict the processing of your personal information.
• Request the portability of your personal information in a structured, commonly used, and machine-readable format.
• Withdraw your consent at any time, if we have collected and processed your personal information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• Opt out of marketing communications sent by Company.

11. How to Exercise Your Rights.

To exercise your rights with respect to information covered by this Privacy Statement, please contact us using the contact details at the bottom of this Privacy Statement. We may require you verify your identity, and we will take steps to verify your identity, including validating your name and the email you use when interacting with us. You may also authorize another person or third party to submit a request to exercise your rights by providing written permission in conjunction with the submission of the requested information or by giving the third party your power of attorney. We will acknowledge your request and provide a follow-up substantive response within a time period permitted by applicable law. In the event that Company needs an extension to fulfill a request, we will notify you. If we deny your request, we will provide reasons for that denial.

We will not discriminate against you for exercising your rights. Company does not make decisions based solely on automated processing that produces legal or similarly significant effects as part of the processing activities covered by this Privacy Statement.

If your personal information has been submitted to us by or on behalf of a Company customer and you wish to exercise any rights you may have under applicable data protection laws, please inquire with the applicable customer directly.

12. Cookies and Tracking Technologies

We use cookies and similar technologies (such as web beacons, pixels, and local storage) to operate and improve our website and to support analytics and functionality.

a. Types of Cookies We Use

We may use the following categories of cookies:

• Strictly Necessary Cookies: Required for the operation of the website, including security, network management, and accessibility.
• Analytics and Performance Cookies: Used to understand how users interact with the website, including through aggregated usage statistics.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering preferences.

We do not use cookies for cross-context behavioral advertising.

b. Third-Party Technologies

We may use third-party service providers (such as analytics providers) that place cookies or similar technologies on our website to assist with measurement, performance, and functionality.

These third parties may collect information about your interactions with the website in accordance with their own privacy policies.

c. Cookie Choices

You can control cookies through your browser settings, including by blocking or deleting cookies. Please note that disabling certain cookies may affect the functionality of the website.

Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device.

d. Opt-Out Preference or Global Privacy Control Signals

Our website may recognize browser-based opt-out signals, such as Global Privacy Control (GPC), where required by applicable law.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

support@opheleon.ai

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and provide notice as required by applicable law.