PRIVACY POLICY

Version: 1.0 | Date: 1st July 2026

INTRODUCTION | SCOPE | INFORMATION WE COLLECT | LEGAL BASES

BRAINPACK PRIVACY POLICY

This Privacy Policy ("Privacy Policy") describes how Memetech LTD, a company incorporated under the laws of the Republic of Cyprus, Registration No. CY10440092L, having its registered office at Agiou Pavlou 61, Agios Andreas, Nicosia 1007, Cyprus ("BrainPack", "Memetech", "Company", "we", "our", or "us"), collects, uses, stores, processes, transfers, discloses, and otherwise handles Personal Information in connection with BrainPack.ai and all related products, services, websites, applications, software platforms, APIs, artificial intelligence services, integrations, and associated offerings (collectively, the "Services").

BrainPack is committed to protecting privacy and processing Personal Information in accordance with applicable privacy and data protection laws, including, where applicable:

• Regulation (EU) 2016/679 ("GDPR");
• UK GDPR;
• Cyprus data protection laws;
• California Consumer Privacy Act ("CCPA");
• California Privacy Rights Act ("CPRA");
• other applicable privacy legislation.

1. SCOPE

This Privacy Policy applies to:

• visitors to BrainPack websites;
• prospective customers;
• trial users;
• registered users;
• customers;
• enterprise customers;
• authorized users;
• applicants;
• support contacts;
• marketing recipients;

and any individual whose Personal Information is processed through the Services.

This Privacy Policy applies regardless of the country from which the Services are accessed.

2. DEFINITIONS

"Personal Information"

Means any information relating to an identified or identifiable natural person.

Personal Information may include:

• name;
• email address;
• telephone number;
• IP address;
• device identifiers;
• location information;
• payment information;
• communications;
• account information;
• employment information;
• CRM records;
• user-generated content;
• AI prompts and interactions.

"Customer Data"

Means information submitted, uploaded, stored, transmitted, generated, processed, or otherwise provided through the Services by or on behalf of Customers.

"AI Interaction Data"

Means prompts, instructions, conversations, commands, uploaded content, requests, outputs, feedback, usage patterns, and related information associated with AI Services.

3. INFORMATION WE COLLECT

BrainPack may collect information directly from users, automatically through technology, from third parties, and through operation of the Services.

3.1 Information Provided Directly by Users

We may collect:

• full name;
• business name;
• employer;
• email address;
• telephone number;
• billing information;
• payment information;
• support requests;
• communications;
• account credentials;
• uploaded files;
• uploaded content;
• AI prompts;
• CRM information;
• ERP information;
• website content;
• inventory information;
• customer records.

3.2 Information Collected Automatically

We may automatically collect:

• IP addresses;
• browser type;
• operating system;
• device identifiers;
• session identifiers;
• pages viewed;
• clickstream data;
• referral URLs;
• timestamps;
• geolocation data;
• performance metrics;
• application logs;
• usage analytics.

3.3 Information from Third Parties

We may receive information from:

• advertising networks;
• social media platforms;
• analytics providers;
• AI providers;
• payment processors;
• cloud providers;
• business partners;
• data enrichment providers;
• public sources.

4. AI PROCESSING

BrainPack provides Services that may utilize:

• Large Language Models (LLMs);
• Generative AI;
• Machine Learning;
• Predictive Systems;
• AI Agents;
• Natural Language Processing;
• Future AI Technologies.

BrainPack may process information through AI systems for purposes including:

• content generation;
• summarization;
• classification;
• extraction;
• workflow automation;
• recommendations;
• search;
• analytics;
• software development;
• customer support;
• product improvement.

4.1 AI Providers

BrainPack may use any current or future artificial intelligence provider, including providers that may process information on BrainPack's behalf.

Such providers may include:

• model providers;
• inference providers;
• cloud AI providers;
• vector database providers;
• machine learning providers;
• agent infrastructure providers;

and any successors or replacements thereof.

BrainPack reserves the right to change AI providers at any time.

4.2 AI Improvement Rights

To the maximum extent permitted by law, BrainPack may use:

• AI Interaction Data;
• usage patterns;
• operational data;
• de-identified information;
• aggregated information;
• statistical information;
• metadata;

for purposes including:

• improving Services;
• improving AI systems;
• training proprietary models;
• benchmarking;
• analytics;
• product development;
• feature enhancement;
• research and development.

BrainPack shall not intentionally use identifiable Customer Confidential Information to train publicly available third-party foundation models unless expressly authorized by the Customer or otherwise permitted by applicable law.

5. LEGAL BASES FOR PROCESSING

Where GDPR applies, BrainPack may process Personal Information based upon one or more of the following legal bases:

Contract Performance

Processing necessary to provide Services.

Legitimate Interests

Processing necessary to:

• improve Services;
• secure Services;
• prevent fraud;
• conduct analytics;
• operate AI systems;
• administer business operations.

Consent

Processing based upon consent where required by law.

Legal Obligations

Processing necessary to comply with legal requirements.

6. PURPOSES OF PROCESSING

BrainPack may process information for the following purposes:

• providing Services;
• maintaining Services;
• securing Services;
• authenticating users;
• processing transactions;
• billing customers;
• operating AI Services;
• customer support;
• technical support;
• communications;
• marketing;
• newsletters;
• product announcements;
• analytics;
• service improvement;
• research and development;
• legal compliance;
• dispute resolution;
• enforcement of agreements.

COOKIES | ANALYTICS | MARKETING | DISCLOSURE OF INFORMATION | INTERNATIONAL TRANSFERS

7. COOKIES AND TRACKING TECHNOLOGIES

BrainPack uses cookies, pixels, tags, scripts, SDKs, local storage technologies, session identifiers, and similar tracking technologies (collectively, "Cookies") to operate, secure, maintain, improve, and market the Services.

Cookies may be placed by BrainPack or by authorized third parties acting on BrainPack's behalf.

7.1 Types of Cookies

BrainPack may utilize:

Strictly Necessary Cookies

Required for:

• authentication;
• login management;
• security;
• fraud prevention;
• load balancing;
• session management;
• functionality necessary for operation of the Services.

These cookies may be used without separate consent where permitted by applicable law.

Functional Cookies

Used to:

• remember preferences;
• remember settings;
• personalize user experience;
• improve usability.

Analytics Cookies

Used to:

• understand user behavior;
• analyze platform usage;
• identify performance issues;
• improve product functionality;
• evaluate feature adoption.

Marketing Cookies

Used to:

• measure advertising performance;
• conduct remarketing;
• conduct retargeting;
• personalize advertising;
• measure campaign effectiveness.

8. ANALYTICS TECHNOLOGIES

BrainPack may utilize analytics technologies including, without limitation:

Google Analytics

For:

• website analytics;
• traffic analysis;
• user behavior analysis;
• conversion tracking.

Meta Pixel

For:

• advertising attribution;
• audience creation;
• conversion tracking;
• marketing optimization.

LinkedIn Insight Tag

For:

• B2B marketing analytics;
• conversion tracking;
• audience measurement;
• campaign optimization.

Hotjar

For:

• behavioral analytics;
• heatmaps;
• user interaction analysis;
• usability improvements.

Microsoft Clarity

For:

• user experience analytics;
• session recordings;
• behavioral insights;
• performance analysis.

BrainPack may add, replace, modify, remove, or discontinue analytics technologies at any time without notice.

9. MARKETING COMMUNICATIONS

BrainPack may send:

• newsletters;
• product announcements;
• service updates;
• promotional communications;
• event invitations;
• educational content;
• surveys;
• marketing campaigns.

9.1 Legal Basis

Where required by applicable law, BrainPack shall obtain consent prior to sending marketing communications.

Where permitted by law, BrainPack may rely upon legitimate interests.

9.2 Opt-Out Rights

Recipients may unsubscribe from marketing communications at any time by:

• clicking unsubscribe links;
• updating account preferences;
• contacting BrainPack.

Opting out of marketing communications shall not prevent BrainPack from sending:

• transactional communications;
• legal notices;
• billing communications;
• service notifications;
• security alerts.

10. DISCLOSURE OF INFORMATION

BrainPack may disclose information under the circumstances described below.

10.1 Service Providers

BrainPack may share information with:

• cloud providers;
• hosting providers;
• infrastructure providers;
• payment processors;
• analytics providers;
• cybersecurity providers;
• communication providers;
• support providers;
• professional advisors.

10.2 AI Providers

BrainPack may disclose information to:

• AI providers;
• LLM providers;
• machine learning providers;
• AI infrastructure providers;
• vector database providers;
• inference providers;
• future AI technology providers.

Such disclosure may occur where reasonably necessary for:

• AI functionality;
• AI processing;
• content generation;
• automation;
• analytics;
• support;
• product improvement.

10.3 Affiliates

BrainPack may disclose information to its Affiliates for legitimate business purposes.

10.4 Corporate Transactions

BrainPack may disclose information in connection with:

• mergers;
• acquisitions;
• investments;
• financing transactions;
• restructuring;
• asset sales;
• due diligence processes.

10.5 Legal Compliance

BrainPack may disclose information where necessary to:

• comply with law;
• comply with court orders;
• comply with governmental requests;
• comply with regulatory obligations;
• protect legal rights;
• enforce agreements.

10.6 Protection of Rights

BrainPack may disclose information where reasonably necessary to:

• prevent fraud;
• investigate misconduct;
• protect users;
• protect infrastructure;
• protect intellectual property;
• protect confidential information.

11. INTERNATIONAL DATA TRANSFERS

BrainPack operates globally.

Customer and users acknowledge that Personal Information may be processed, transferred, stored, accessed, or otherwise handled in any jurisdiction worldwide.

Such jurisdictions may include countries whose privacy protections differ from those of the user's country of residence.

11.1 Global Infrastructure

BrainPack may utilize infrastructure located anywhere in the world, including infrastructure operated by:

• cloud providers;
• hosting providers;
• AI providers;
• backup providers;
• analytics providers;
• cybersecurity providers.

11.2 Transfer Mechanisms

Where required by applicable law, BrainPack may rely upon:

• Standard Contractual Clauses (SCCs);
• adequacy decisions;
• contractual safeguards;
• certification mechanisms;
• other legally recognized transfer mechanisms.

12. SUBPROCESSORS

BrainPack may engage subprocessors to process information on its behalf.

Subprocessors may include providers of:

• hosting;
• cloud infrastructure;
• artificial intelligence;
• communications;
• analytics;
• cybersecurity;
• billing;
• customer support;
• monitoring.

BrainPack reserves the right to add, replace, or remove sub processors at any time.

13. AGGREGATED, ANONYMIZED, AND DE-IDENTIFIED INFORMATION

BrainPack may create, derive, generate, compile, analyze, commercialize, license, distribute, and otherwise utilize:

• anonymized information;
• de-identified information;
• aggregated information;
• benchmarking information;
• usage statistics;
• operational analytics;
• machine learning datasets.

Such information shall not be considered Personal Information once properly anonymized or de-identified.

13.1 Product Improvement Rights

BrainPack may use anonymized, aggregated, statistical, and de-identified information to:

• improve Services;
• improve AI systems;
• train proprietary models;
• develop new features;
• perform analytics;
• conduct research;
• create benchmarks;
• support business operations.

All rights in such derived information shall belong exclusively to BrainPack.

14. AUTOMATED PROCESSING

BrainPack may utilize automated systems for:

• fraud detection;
• abuse prevention;
• security monitoring;
• workflow automation;
• AI processing;
• recommendation engines;
• classification systems;
• personalization.

Automated processing may be used as part of the operation of the Services.

14.1 No Guaranteed Human Review

Certain automated operations may occur without prior human review.

Users acknowledge and accept such processing as part of the Services.

DATA RETENTION | SECURITY | GDPR RIGHTS | CCPA RIGHTS | CHILDREN | CONTACT INFORMATION

15. DATA RETENTION

15.1 General Retention Principles

BrainPack retains Personal Information only for as long as reasonably necessary to:

• provide the Services;
• perform contractual obligations;
• maintain business operations;
• comply with legal obligations;
• resolve disputes;
• enforce agreements;
• protect legal rights;
• maintain security;
• conduct audits;
• improve products and services.

BrainPack may retain information for longer periods where required or permitted by applicable law.

15.2 Retention Periods

Retention periods may vary depending upon:

• the nature of the information;
• legal requirements;
• contractual requirements;
• operational requirements;
• security requirements;
• regulatory requirements.

BrainPack retains information for as long as reasonably necessary for business, legal, compliance, contractual, and operational purposes.

15.3 Backups

Information may remain within:

• backup systems;
• disaster recovery systems;
• archived environments;
• security logs;

for a reasonable period following deletion from active systems.

BrainPack may maintain backup copies in accordance with operational and security requirements.

15.4 Deletion Requests

Where applicable law provides deletion rights, BrainPack shall evaluate deletion requests in accordance with:

• legal obligations;
• contractual obligations;
• security requirements;
• legitimate business interests.

BrainPack may refuse deletion requests where permitted by applicable law.

16. SECURITY MEASURES

16.1 Security Program

BrainPack maintains administrative, technical, organizational, and physical safeguards designed to protect information from:

• unauthorized access;
• unauthorized disclosure;
• accidental destruction;
• accidental loss;
• misuse;
• alteration.

16.2 Examples of Security Measures

BrainPack may implement measures including:

• encryption;
• access controls;
• authentication mechanisms;
• network monitoring;
• intrusion detection;
• vulnerability management;
• logging;
• auditing;
• disaster recovery planning;
• backup procedures.

The specific security measures employed may change over time.

16.3 No Absolute Security

No security system can provide absolute protection.

Accordingly, BrainPack does not guarantee that information will never be:

• accessed;
• disclosed;
• altered;
• destroyed;

through unauthorized means.

Users acknowledge and accept the inherent risks associated with internet-based services.

17. GDPR RIGHTS

Where the GDPR applies, individuals may have certain rights regarding their Personal Information.

Such rights may include:

17.1 Right of Access

The right to obtain confirmation regarding whether Personal Information is processed and to access such information.

17.2 Right to Rectification

The right to request correction of inaccurate or incomplete Personal Information.

17.3 Right to Erasure

The right to request deletion of Personal Information in certain circumstances.

17.4 Right to Restrict Processing

The right to request restriction of processing under certain conditions.

17.5 Right to Data Portability

The right to receive Personal Information in a structured, commonly used, and machine-readable format where applicable.

17.6 Right to Object

The right to object to certain processing activities, including certain marketing activities.

17.7 Right to Withdraw Consent

Where processing is based upon consent, individuals may withdraw consent at any time.

Withdrawal shall not affect the lawfulness of processing conducted prior to withdrawal.

17.8 Right to Lodge Complaints

Individuals may lodge complaints with competent supervisory authorities.

For individuals located within the European Economic Area, complaints may generally be submitted to the supervisory authority in their country of residence.

18. UK GDPR RIGHTS

Individuals located within the United Kingdom may possess rights substantially similar to those described under the GDPR.

BrainPack shall process such requests in accordance with applicable UK privacy legislation.

19. CALIFORNIA PRIVACY RIGHTS

Where applicable, California residents may possess rights under:

• California Consumer Privacy Act (CCPA);
• California Privacy Rights Act (CPRA).

19.1 Right to Know

The right to request information regarding:

• categories of Personal Information collected;
• sources of Personal Information;
• purposes of collection;
• categories of disclosures.

19.2 Right to Access

The right to request access to certain Personal Information.

19.3 Right to Correct

The right to request correction of inaccurate Personal Information.

19.4 Right to Delete

The right to request deletion of Personal Information, subject to applicable exceptions.

19.5 Right to Non-Discrimination

BrainPack shall not discriminate against individuals for exercising applicable privacy rights.

20. EXERCISING PRIVACY RIGHTS

Individuals wishing to exercise privacy rights may submit requests using contact details published by BrainPack.

BrainPack may:

• verify identity;
• request additional information;
• refuse fraudulent requests;
• refuse requests where permitted by law.

BrainPack shall respond within the timeframes required by applicable law.

21. CHILDREN'S PRIVACY

The Services are intended solely for individuals who are at least eighteen (18) years of age.

BrainPack does not knowingly collect Personal Information from children.

If BrainPack becomes aware that Personal Information has been collected from a child in violation of applicable law, BrainPack may delete such information without notice.

Parents or guardians who believe information regarding a child has been collected may contact BrainPack.

22. THIRD-PARTY WEBSITES

The Services may contain links to third-party websites, applications, services, or resources.

BrainPack is not responsible for:

• privacy practices;
• security practices;
• content;
• policies;

of third parties.

Users are encouraged to review the privacy policies of such third parties.

23. CHANGES TO THIS PRIVACY POLICY

BrainPack may modify this Privacy Policy at any time.

Updated versions may be published through:

• websites;
• applications;
• user dashboards;
• electronic communications.

The effective date shall be updated accordingly.

Continued use of the Services after modifications become effective shall constitute acceptance of the updated Privacy Policy.

24. CONTACT INFORMATION

Questions regarding this Privacy Policy or privacy practices may be directed to:

Memetech LTD
Agiou Pavlou 61
Agios Andreas
Nicosia 1007
Cyprus

Email: [email protected]

or through the contact methods published on the BrainPack website.

25. LANGUAGE

This Privacy Policy may be translated into multiple languages.

In the event of inconsistency between translated versions and the English version, the English version shall prevail to the maximum extent permitted by law.

26. EFFECTIVE DATE

This Privacy Policy becomes effective upon publication by BrainPack and shall remain effective until replaced by a newer version.

FINAL ACKNOWLEDGEMENT

By accessing, browsing, registering for, subscribing to, or using the Services, users acknowledge that they have read and understood this Privacy Policy.

Users further acknowledge that BrainPack may:

• utilize Artificial Intelligence technologies;
• engage current and future AI providers;
• process information globally;
• transfer information internationally;
• use anonymized and aggregated information for product improvement, analytics, machine learning, benchmarking, research, and development purposes;

all in accordance with this Privacy Policy and applicable law.