Privacy Notice for California Residents

This Privacy Notice for California Residents (this "California Notice") supplements the AlphaLens Privacy Notice and addresses the additional disclosures required of, and the additional rights granted to, California residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100-1798.199.100), and the regulations promulgated thereunder by the California Privacy Protection Agency (Cal. Code Regs. tit. 11, §§ 7000 et seq.) (together, the "CCPA").

This California Notice applies to natural persons who reside in the State of California ("consumer" or "you"). Capitalised terms used and not otherwise defined in this California Notice have the meanings given to them in the CCPA.

In this California Notice, "AlphaLens," "we," "us," and "our" refer to Deckmatch, Inc. DBA AlphaLens. "Personal Information" has the meaning given in Cal. Civ. Code § 1798.140(v). "Sensitive Personal Information" has the meaning given in Cal. Civ. Code § 1798.140(ae). "Sell," "Share," "Service Provider," and "Contractor" have the meanings given in the CCPA.

If you need this California Notice in an alternative format because of a disability, please contact us at contact@alphalens.ai.

1. Our Roles Under the CCPA

AlphaLens operates two principal lines of activity that bear on Personal Information of California residents:

Our platform and database. We provide the AlphaLens competitive-intelligence platform and we maintain a database of companies, products, and individuals associated with companies, compiled and curated from publicly available and licensed sources. With respect to the database and the operation of the platform, AlphaLens is a "business" under the CCPA.

Pitch deck processing, custom research, and CRM integrations. We process pitch decks and other documents, custom research questions, and data accessed through CRM and other business-tool integrations on the documented instructions of our customers. With respect to the Personal Information we process when delivering these services, AlphaLens acts as a Service Provider and, where applicable, a Contractor, and our customer is the business. Our processing is governed by a written agreement that complies with Cal. Civ. Code § 1798.140(ag)(1) and § 1798.140(j)(1).

This California Notice addresses both roles. Where AlphaLens acts as a Service Provider, you should direct rights requests in the first instance to the relevant customer; AlphaLens will assist its customers in responding to consumer requests as required by contract and by law.

2. Categories of Personal Information We Collect

In the twelve (12) months preceding the effective date of this California Notice, AlphaLens has collected the following statutory categories of Personal Information about California residents.

A. Identifiers

• Examples we collect: name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, professional profile URL.
• Sources: the consumer directly, the consumer's employer, publicly available sources, licensed data providers, and automatic collection from devices interacting with our website and platform.
• Business or commercial purposes: providing and operating the AlphaLens platform and database; account creation and authentication; communications; marketing where consented; security, fraud prevention, and service integrity; quality assurance and product improvement; legal and regulatory compliance.
• Disclosed for a business purpose to: Service Providers and Contractors providing cloud hosting and infrastructure, AI and large-language-model processing, document parsing, analytics, customer-relationship and business-tool integrations, error monitoring, customer support, billing and payment processing, and email delivery; AlphaLens customers receiving query results from the database or content they themselves uploaded; and other third parties as described in Section 5.
• Sold or Shared: No.
• Retention: As described in Section 4.

B. Customer Records Information

• Examples we collect: name, signature, address, telephone number, employer, job title, and billing or financial information necessary to administer subscription agreements. AlphaLens does not store full payment-card numbers.
• Sources: the consumer directly, the consumer's employer, payment processors.
• Business or commercial purposes: entering into and performing customer agreements; billing and collections; legal, regulatory, accounting, and tax compliance; corporate-record keeping.
• Disclosed for a business purpose to: Service Providers and Contractors providing payment processing, billing, accounting, tax, and legal advisors; auditors; banks.
• Sold or Shared: No.
• Retention: As described in Section 4.

C. Protected Classification Characteristics

We do not deliberately collect characteristics of protected classifications under California or federal law.

D. Commercial Information

• Examples we collect: records of products or services purchased, obtained, or considered; subscription history; usage patterns within the platform.
• Sources: the consumer directly through use of the platform, automatically collected.
• Business or commercial purposes: providing the services; service-related communications; product analytics and improvement; security and fraud prevention.
• Disclosed for a business purpose to: Service Providers providing analytics, hosting, and customer support.
• Sold or Shared: No.
• Retention: As described in Section 4.

E. Biometric Information

We do not collect biometric information.

F. Internet or Other Electronic Network Activity Information

• Examples we collect: browsing history within our website and platform, search queries, natural-language research questions, interactions with our services, log and clickstream data, referring URLs, information about the device and browser used.
• Sources: automatically collected through the consumer's interaction with our website and platform.
• Business or commercial purposes: providing, securing, and improving the services; analytics; product development; troubleshooting and support.
• Disclosed for a business purpose to: Service Providers providing analytics, error monitoring, hosting, and AI/LLM processing.
• Sold or Shared: No.
• Retention: As described in Section 4.

G. Geolocation Data

• Examples we collect: approximate city or region-level location data inferred from IP address. We do not collect precise geolocation as defined under the CCPA.
• Sources: automatically collected.
• Business or commercial purposes: security, fraud prevention, regulatory compliance, and analytics.
• Disclosed for a business purpose to: Service Providers providing analytics, security, and hosting.
• Sold or Shared: No.
• Retention: As described in Section 4.

H. Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information

• Examples we collect: content of customer-uploaded pitch decks and similar documents, which may include images and embedded media.
• Sources: the customer acting as the controlling business, the consumer directly.
• Business or commercial purposes: delivering the services on the customer's instructions; quality assurance; security.
• Disclosed for a business purpose to: Service Providers providing hosting, document parsing, AI/LLM processing.
• Sold or Shared: No.
• Retention: As described in Section 4.

I. Professional or Employment-Related Information

• Examples we collect: current and prior employer(s) and job titles, professional biography, professional profile URLs, founder, executive, board, or advisor role attributions, publicly reported professional activities, and, for job applicants, CV, application, references, and certificates.
• Sources: publicly available sources, licensed data providers, the consumer directly, the consumer's employer.
• Business or commercial purposes: providing the AlphaLens platform and database; sourcing, screening, and competitive-intelligence functions used by our customers; recruitment.
• Disclosed for a business purpose to: Service Providers providing hosting, AI/LLM processing, and recruitment tools; AlphaLens customers querying the database; recruiting partners.
• Sold or Shared: No.
• Retention: As described in Section 4.

J. Education Information

• Examples we collect: education history disclosed in publicly available professional profiles, in pitch decks, or in job applications where applicable.
• Sources: publicly available sources, the consumer directly.
• Business or commercial purposes: professional intelligence; recruitment.
• Disclosed for a business purpose to: Service Providers providing hosting and AI/LLM processing; AlphaLens customers for database content; recruiting partners for applicants.
• Sold or Shared: No.
• Retention: As described in Section 4.

K. Inferences

• Examples we collect: inferences drawn about companies and products from the foregoing categories, for example classifications, summaries, and profile attributes generated by AI extraction and enrichment. We do not generate inferences intended to create a profile of a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, or aptitudes.
• Sources: derived by AlphaLens from the categories above.
• Business or commercial purposes: providing the platform and database.
• Disclosed for a business purpose to: Service Providers providing hosting and AI/LLM processing; AlphaLens customers for database content.
• Sold or Shared: No.
• Retention: As described in Section 4.

L. Sensitive Personal Information

We do not collect Sensitive Personal Information for the purpose of inferring characteristics about a consumer. We do not knowingly collect government identifiers, account log-in combinations sufficient to access an account, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of mail, email, and text messages other than as necessary to provide the services as directed, genetic data, biometric information for the purpose of uniquely identifying a consumer, health data, or data about sex life or sexual orientation.

To the extent we incidentally process Sensitive Personal Information that appears in customer-uploaded documents or in publicly available sources, we use such information only for the limited purposes permitted by Cal. Civ. Code § 1798.121(a) and the implementing regulations, such as performing the services, ensuring security and integrity, and resisting malicious or fraudulent activity. Accordingly, the right to limit the use and disclosure of Sensitive Personal Information described in Section 5.7 does not currently apply because we do not use Sensitive Personal Information for purposes that would trigger that right.

3. Sale and Sharing of Personal Information

AlphaLens does not Sell Personal Information for monetary consideration, and AlphaLens does not Share Personal Information for cross-context behavioural advertising.

In the twelve (12) months preceding the effective date of this California Notice, AlphaLens has not Sold or Shared the Personal Information of California consumers, and AlphaLens has not Sold or Shared the Personal Information of consumers under sixteen (16) years of age. We do not have actual knowledge that we Sell or Share the Personal Information of consumers under sixteen (16) years of age.

We disclose Personal Information to Service Providers and Contractors for business purposes as described in Section 2. We may also disclose Personal Information as described in the Privacy Notice, for example to comply with legal obligations or in connection with a corporate transaction. Disclosures of this nature are not Sales or Sharing under the CCPA.

The AlphaLens database described in Section 1 consists of professional and business information about identified individuals acting in a professional capacity, drawn from publicly available and licensed sources, and is provided to our customers in connection with their lawful business activities. AlphaLens treats this activity as the provision of a competitive-intelligence service to a paying customer rather than as the Sale or Sharing of Personal Information.

4. Retention

We retain Personal Information for as long as is reasonably necessary to fulfil the purposes for which it was collected, subject to applicable legal, accounting, tax, contractual, and dispute-resolution requirements. The criteria we use to determine retention periods include:

• the duration of our relationship with the consumer or customer;
• the nature and sensitivity of the Personal Information;
• the legitimate purposes for which the Personal Information was collected, including the operation of the AlphaLens database;
• the existence of any legal, contractual, or regulatory obligation requiring retention, typically up to five years following the end of the customer relationship for accounting and tax records;
• whether the underlying public information about a person remains accurate, current, and relevant to professional-intelligence purposes.

Personal Information processed on behalf of our customers, for example content of pitch decks, custom research queries, or CRM data accessed through an integration, is retained on the customer's instruction in accordance with the relevant data processing agreement and is returned or deleted on termination of the customer agreement, subject to retention required by law.

5. Your California Privacy Rights

Subject to certain exceptions and verification, California residents have the following rights with respect to Personal Information that AlphaLens processes as a business.

5.1 Right to Know

You have the right to request that we disclose to you the categories of Personal Information we have collected about you, the categories of sources from which the Personal Information was collected, the business or commercial purposes for collecting, Selling, or Sharing the Personal Information, the categories of third parties to whom we have disclosed the Personal Information, and the specific pieces of Personal Information we have collected about you.

5.2 Right to Access Specific Pieces

You have the right to request that we provide you with the specific pieces of Personal Information we have collected about you.

5.3 Right to Correct

You have the right to request that we correct inaccurate Personal Information that we maintain about you, subject to verification and to the limits set by Cal. Civ. Code § 1798.106 and the regulations.

5.4 Right to Delete

You have the right to request that we delete Personal Information that we have collected from you, subject to certain exceptions set by Cal. Civ. Code § 1798.105(d) and the regulations.

5.5 Right to Portability

For Personal Information you have provided to us, you have the right to request a copy of that Personal Information in a structured, commonly used, and machine-readable format that allows you to transmit the data to another entity without hindrance.

5.6 Right to Opt Out of Sale or Sharing

If we Sold or Shared your Personal Information, you would have the right to opt out. As described in Section 3, AlphaLens does not Sell or Share Personal Information. We will update this California Notice and provide a "Do Not Sell or Share My Personal Information" link if our practices change.

5.7 Right to Limit Use and Disclosure of Sensitive Personal Information

If we used or disclosed Sensitive Personal Information for purposes other than those permitted by Cal. Civ. Code § 1798.121(a), you would have the right to limit such use and disclosure. As described in Section 2.L, AlphaLens does not currently use Sensitive Personal Information for purposes that trigger that right.

5.8 Right to Non-Discrimination

You have the right not to receive discriminatory treatment by AlphaLens for exercising your rights under the CCPA. AlphaLens does not offer financial incentives that are contingent on the processing of Personal Information.

5.9 Right to Designate an Authorised Agent

You have the right to designate an authorised agent to make a request on your behalf, as described in Section 7 below.

6. How to Submit a Request - and How We Verify You

You may submit a request to exercise your California privacy rights by emailing us at contact@alphalens.ai with the subject line "California Privacy Request" or by writing to Deckmatch, Inc. DBA AlphaLens, 470 Ramona St, Palo Alto, CA 94301-1707, USA.

To protect Personal Information from unauthorised access, deletion, or correction, we will need to verify your identity before responding to a verifiable consumer request. We will ask you to provide information that allows us to reasonably verify that you are the person about whom we have collected Personal Information, which may include matching information you provide against information already in our possession, such as the email address associated with your account or with a record in the AlphaLens database. For requests involving the deletion or correction of specific pieces of Personal Information, we may require a higher degree of certainty.

We strive to respond to verifiable requests within forty-five (45) days of receipt, with a single forty-five-day extension where reasonably necessary, and we will inform you in writing of any extension and the reason for it.

We will not charge a fee to process or respond to a verifiable consumer request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request as permitted under Cal. Civ. Code § 1798.130(a)(2)(B).

7. Authorised Agents

You may designate an authorised agent to make a request on your behalf. To designate an authorised agent, you must provide the authorised agent with signed, written permission to act on your behalf, verify your own identity directly with us, and directly confirm to us that you provided the authorised agent with permission to submit the request. We may deny a request from an authorised agent that does not submit proof that the agent has been authorised by you to act on your behalf.

8. Opt-Out Preference Signals (Global Privacy Control)

The CCPA requires businesses that Sell or Share Personal Information to recognise opt-out preference signals such as the Global Privacy Control ("GPC"). Because AlphaLens does not Sell or Share Personal Information, we do not currently process opt-out preference signals as opt-outs of Sale or Sharing. We will update this California Notice and the website to recognise GPC if our practices change.

9. "Do Not Track" Signals

Our website does not respond to Do Not Track ("DNT") signals from web browsers because there is no industry-standard mechanism for a business to do so. We treat all visitors consistently regardless of DNT signal status.

10. Minors

The AlphaLens services are intended for business use and are not directed to minors. We do not knowingly collect Personal Information from consumers under the age of eighteen (18), and we do not have actual knowledge that we Sell or Share the Personal Information of consumers under the age of sixteen (16). If you believe that we have collected Personal Information from a minor, please contact us at contact@alphalens.ai and we will take steps to delete the information.

11. Notice of Right to Limit, Notice of Right to Opt Out, Notice at Collection

This California Notice, together with the Privacy Notice, serves as our Notice at Collection under Cal. Civ. Code § 1798.100(a) and as the disclosures under Cal. Civ. Code § 1798.130 with respect to the categories of Personal Information collected, the purposes for which the categories are used, and the retention period for each category. As described in Sections 3, 5.6, and 5.7, AlphaLens does not currently provide a "Do Not Sell or Share My Personal Information" link or a "Limit the Use of My Sensitive Personal Information" link because the corresponding rights are not currently triggered. We will update this California Notice if our practices change.

12. California Shine the Light

California's "Shine the Light" law (Cal. Civ. Code § 1798.83) entitles California residents who have an established business relationship with us to request, once per calendar year, information about the disclosure of certain categories of Personal Information to third parties for the third parties' direct-marketing purposes. AlphaLens does not disclose Personal Information to third parties for those parties' own direct-marketing purposes.

13. Changes to This California Notice

We will update this California Notice as needed to reflect changes in applicable law or our practices. When we make material changes, we will notify you through reasonable means, such as by posting a prominent notice on our website or by emailing you. The "Last updated" date at the top of this California Notice indicates when it was most recently revised.

14. Contact Information

If you have questions or concerns about this California Notice or our privacy practices, or if you wish to exercise any of your California privacy rights:

• Email: contact@alphalens.ai
• Postal address: Deckmatch, Inc. DBA AlphaLens, 470 Ramona St, Palo Alto, CA 94301-1707, USA

If you need to access this California Notice in an alternative format because of a disability, please contact us using the details above.