Privacy Policy

Effective date: October 15, 2026
Last updated: October 15, 2026

Nutgraf Intelligence, Inc. (“Nutgraf,” the “Company,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy describes how we collect, use, disclose, retain and otherwise process Personal Information in connection with our website located at nutgraf.ai (including its legal pages), our waitlist, our related email communications and any correspondence you send to us (collectively, the “Services”), and explains the rights and choices available to you.

This Privacy Policy is a notice that explains our practices. It is not a contract and does not form part of our Terms of Use, which separately govern your use of the Services.

1.Scope and controller

1.1 Who is responsible for your Personal Information

Nutgraf Intelligence, Inc., a Delaware corporation, is responsible for the Personal Information described in this Privacy Policy. To the extent the following laws apply, Nutgraf is the “controller” of that Personal Information for purposes of the GDPR, the UK GDPR and the FADP, and the “business” or “controller” for purposes of the CCPA and other U.S. state privacy laws. Our contact details are set out in Section 22.

1.2 What this Privacy Policy covers

This Privacy Policy applies to Personal Information that we process in connection with the Services, whether you visit our website, join our Waitlist, receive our emails or contact us. It does not apply to:

the Nutgraf market research product, which has not yet launched; before you can use the product, we will make available an updated or supplemental privacy policy describing any additional processing in connection with it;
websites, applications and services operated by third parties, including those to which the Services link; or
the processing of information by third parties acting on their own behalf, such as your internet service provider, your browser developer or your email provider, each of which processes information under its own privacy policy.

2.Definitions

In this Privacy Policy, the following terms have the meanings set out below. Other capitalized terms have the meanings given to them where they first appear.

“Applicable Data Protection Law” means any law or regulation relating to privacy, data protection or the processing of Personal Information that applies to our processing of your Personal Information, which may include, depending on where you are located, the GDPR, the UK GDPR, the FADP, the CCPA, the other U.S. state privacy laws referred to in Section 16, PIPEDA and the Law of the Republic of Azerbaijan on Personal Data.
“CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, together with its implementing regulations.
“EEA” means the European Economic Area.
“FADP” means the Swiss Federal Act on Data Protection of September 25, 2020, together with its implementing ordinances.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (the General Data Protection Regulation).
“Personal Information” means any information that identifies, relates to, describes or is reasonably capable of being associated with, directly or indirectly, an identified or identifiable natural person, and includes “personal data,” “personal information” and similar terms as defined under Applicable Data Protection Law. Personal Information does not include information that has been aggregated or de-identified so that it can no longer reasonably be associated with an individual.
“PIPEDA” means Canada’s Personal Information Protection and Electronic Documents Act.
“Process” and “processing” mean any operation performed on Personal Information, such as collection, recording, organization, storage, use, disclosure, transfer, restriction and deletion.
“Sell,” “sale,” “share” and “sharing” have the meanings given to them in the CCPA and, as applicable, other U.S. state privacy laws, and “targeted advertising” has the meaning given to it in applicable U.S. state privacy laws. In general, “sharing” means making Personal Information available to a third party for cross-context behavioral advertising, and “targeted advertising” means displaying advertisements to an individual based on Personal Information obtained from that individual’s activities over time and across unaffiliated websites or online applications.
“Sensitive Personal Information” means Personal Information that Applicable Data Protection Law treats as sensitive or as a special category of data, such as government-issued identification numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, health information, information concerning sex life or sexual orientation, and genetic or biometric data.
“Service Provider” means a person or entity that processes Personal Information on our behalf and in accordance with our instructions, including a “processor” under the GDPR and the UK GDPR and a “service provider” or “contractor” under the CCPA.
“UK GDPR” means the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland, together with the UK Data Protection Act 2018, each as amended.
“Waitlist” means the list of individuals who have submitted their email address through the form on our website to be notified about, and considered for, early access to the Nutgraf product, and to receive the related emails described in Section 12.
“You” and “your” refer to any individual whose Personal Information we process in connection with the Services.

3.Information we collect

We collect only the categories of Personal Information described below, from the sources indicated.

3.1 Information you provide to us

Waitlist email address. The email address you enter in the waitlist form on our website. Source: you.
Correspondence. If you email us at contact@nutgraf.ai or otherwise contact us, the email address from which you write, your name and any other information you include in your message or signature, any attachments, and the metadata associated with your message, such as the date and time it was sent and its technical header information, which may include the IP address of the device or mail server from which it was sent. Source: you.
Request information. Information that you or your authorized agent provide when you submit a request to exercise your privacy rights, including any information needed to verify the request, as described in Section 13. Source: you or your authorized agent.

3.2 Information recorded when you join the Waitlist

Browser type. When you submit the waitlist form, our server records the user-agent string that your browser sends with that submission as a standard part of the request. A user-agent string identifies your browser type and version and may also indicate your operating system and the general type of device you are using. We do not use scripts to read your browser’s settings or any other information stored on your device. Source: your browser.
Signup date and time. The date and time at which you submitted the waitlist form, as recorded by our server. Source: generated when you submit the form.
Confirmation date and time. If we ask you to confirm your email address, as described in Section 12.1, the date and time at which you do so. Source: generated when you confirm.

Except as described in Section 3.3, we do not collect this information from visitors who browse the website without submitting the waitlist form.

3.3 Information processed by our hosting provider

A website cannot be delivered to your device without processing your device’s Internet Protocol (“IP”) address. When you visit our website, our hosting provider processes your IP address, together with the technical information your browser sends with each request (such as the address of the page requested, the date and time of the request, your browser’s user-agent string and, in some cases, the address of the page that referred you), in order to transmit the website to you, and may record this information in standard server and security logs that are used to operate, secure and troubleshoot the Services. Other than any IP address that appears in the technical header of an email you send to us, Nutgraf does not itself store IP addresses. Because our hosting provider processes this information on our behalf, however, we treat it as Personal Information under this Privacy Policy. Source: your browser and device, through our hosting provider.

3.4 Information generated when we email you

When we send you emails, our email service provider generates the records needed to deliver our messages and to honor your choices, such as whether a message was delivered or returned as undeliverable and whether and when you unsubscribed. When you select a link in one of our emails, including the unsubscribe link, our email service provider necessarily processes your device’s IP address and user-agent string to complete your request and may record them in its standard service and security logs. Our email service provider may also generate the email engagement information described in Section 12.4. Source: our email service provider.

3.5 Information we do not collect

The waitlist form does not ask for, and we do not request through the Services, your name, telephone number, postal address, date of birth, country of residence, payment card, bank, brokerage or digital asset wallet information, government-issued identification numbers, precise geolocation or any other Sensitive Personal Information. If we need additional information from you, for example to determine whether we are able to offer you early access in your jurisdiction, we will ask you for it and tell you how we will use it. We do not purchase or otherwise obtain Personal Information about you from data brokers, advertising networks, social media platforms or other commercial sources.

Please do not include Sensitive Personal Information in any message you send to us. We do not request or intentionally collect Sensitive Personal Information or “consumer health data” as defined in the Washington My Health My Data Act or similar laws of other states. If you choose to include such information in a message to us, we use it only to respond to you and to keep a record of our correspondence.

3.6 Whether you must provide Personal Information

You are not required by law or by contract to provide any Personal Information to us. Providing your email address is voluntary, but if you do not provide it, you will not be able to join the Waitlist or receive our emails. You may browse the website without joining the Waitlist.

4.How we use information

4.1 Purposes of processing

We process Personal Information for the following purposes:

to add you to the Waitlist, administer it, select and invite Waitlist members for early access, and notify you when early access to the Nutgraf product becomes available and when the product launches;
to send you the other emails described in Section 12.1, including the Nutgraf newsletter and its news and updates about Nutgraf and the Nutgraf product, and to monitor their delivery and, where permitted, their performance, as described in Section 12.4;
to keep a record of your signup and of your consent, and to honor your unsubscribe and other preferences, including by maintaining a suppression list;
to deliver, operate, maintain and troubleshoot the website;
to protect the security and integrity of the Services, including to detect, prevent and respond to fraudulent, automated or abusive signups, spam and other malicious activity;
to understand which browsers and types of device are used by the people who join the Waitlist, so that our website and future product work properly for them;
to respond to your messages, inquiries and requests, including requests to exercise your privacy rights;
to comply with applicable laws, regulations, legal process and lawful requests from public authorities; to establish, exercise or defend legal claims; to enforce our Terms of Use; and to protect the rights, property and safety of Nutgraf, our users and others;
to evaluate, negotiate and carry out a corporate transaction of the kind described in Section 6; and
for any other purpose that we describe to you when we collect the information, or with your consent.

4.2 Automated decision-making and artificial intelligence

We do not use Personal Information to make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you. We do not use the Personal Information described in this Privacy Policy to train artificial intelligence or machine learning models.

4.3 Aggregated and de-identified information

We may create aggregated statistics from Personal Information, such as the total number of Waitlist signups over a period of time or the proportion of signups made using a particular browser, and we may use and disclose those statistics for any lawful purpose, including to report on our progress to current or prospective investors. To the extent we maintain information in de-identified form, we will take reasonable measures to ensure that it cannot be associated with an individual, will maintain and use it only in de-identified form, will not attempt to re-identify it except as permitted by Applicable Data Protection Law, and will contractually require any recipient of that information to comply with these obligations.

4.4 New purposes

We will not process Personal Information for purposes that are materially different from, or incompatible with, those described in this Privacy Policy without first providing you with notice and, where required by Applicable Data Protection Law, obtaining your consent.

5.Legal bases for processing (EEA, UK and Switzerland)

If you are located in the EEA, the United Kingdom or Switzerland, or if the GDPR, the UK GDPR or the FADP otherwise applies to our processing of your Personal Information, we rely on the following legal bases:

Purpose	Personal Information	Legal basis
Administering the Waitlist, selecting Waitlist members for early access and sending the emails described in Section 12.1 (Section 4.1(a) and (b))	Waitlist email address; signup and confirmation dates and times; email delivery records	Your consent (Article 6(1)(a) GDPR and UK GDPR), which is also the basis on which we send electronic marketing under the ePrivacy laws that apply to you, including, in the United Kingdom, the Privacy and Electronic Communications Regulations 2003
Measuring whether our emails are opened and whether links in them are selected, where our email service provider records this information (Sections 4.1(b) and 12.4)	Email engagement information	Your consent, where Applicable Data Protection Law requires it (Article 6(1)(a)); otherwise, our legitimate interests in understanding the effectiveness of our emails (Article 6(1)(f))
Keeping records of your signup and consent, and honoring your unsubscribe preferences (Section 4.1(c))	Waitlist email address; browser type; signup and confirmation dates and times; email delivery and unsubscribe records	Compliance with our legal obligations, including the obligations to be able to demonstrate your consent and to honor objections to direct marketing (Article 6(1)(c)); and our legitimate interests in maintaining accurate records (Article 6(1)(f))
Delivering, operating and troubleshooting the website (Section 4.1(d))	Server log information, including IP address	Our legitimate interests in providing a functioning website to the visitors who request it (Article 6(1)(f))
Protecting the security and integrity of the Services (Section 4.1(e))	Server log information, including IP address; browser type; signup date and time	Our legitimate interests in protecting the Services and the Waitlist against fraud, abuse and security threats (Article 6(1)(f))
Ensuring that our website and future product work properly for Waitlist members (Section 4.1(f))	Browser type	Our legitimate interests in ensuring that our website and future product function properly for the people interested in them (Article 6(1)(f))
Responding to your messages, inquiries and requests (Section 4.1(g))	Correspondence; request information	Our legitimate interests in responding to you (Article 6(1)(f)); and, for requests to exercise your rights, compliance with our legal obligations (Article 6(1)(c))
Legal compliance and protection of rights (Section 4.1(h))	Any of the Personal Information described in Section 3, as relevant	Compliance with our legal obligations (Article 6(1)(c)); and our legitimate interests in establishing, exercising or defending legal claims and in protecting our rights and those of others (Article 6(1)(f))
Corporate transactions (Section 4.1(i))	Any of the Personal Information described in Section 3, as relevant	Our legitimate interests in evaluating and carrying out such transactions (Article 6(1)(f))
Other purposes described at collection (Section 4.1(j))	As described to you at the time	Your consent, or another legal basis that we will identify to you at the time

Consent. Where we rely on your consent, you give it as described in Section 12.1. You may withdraw it at any time by unsubscribing as described in Section 12.2 or by contacting us. Withdrawing your consent does not affect the lawfulness of processing carried out before you withdrew it.

Legitimate interests. We rely on our legitimate interests only where they are not overridden by your interests, fundamental rights and freedoms, taking into account the limited nature of the Personal Information involved, your reasonable expectations and the safeguards we apply. You may object to processing based on our legitimate interests, as described in Section 14.1, and you may request further information about how we have balanced those interests by contacting us.

Switzerland. Swiss law does not generally require a legal basis for the processing of Personal Information. To the extent the FADP requires a justification for any processing, we rely on the grounds described above.

6.How we disclose information

We disclose Personal Information only to the categories of recipients, and in the circumstances, described below:

Service Providers. We disclose Personal Information to Service Providers that perform services on our behalf, namely a hosting provider that delivers and secures our website, an email service provider that sends our emails and stores the Waitlist on our behalf, and the provider of the email hosting services through which we receive and respond to correspondence. We engage Service Providers under written terms that limit their use of Personal Information to providing services to us and to the other limited purposes that Applicable Data Protection Law permits processors and service providers to pursue, such as detecting security incidents and preventing fraud; that prohibit them from selling or sharing it; and that require them to protect it.
Professional advisors. We may disclose Personal Information to our lawyers, accountants, auditors and other professional advisors, who are bound by duties of confidentiality, where necessary to obtain their advice or services.
Legal requirements and protection of rights. We may disclose Personal Information to courts, law enforcement agencies, regulators and other public authorities, or to other third parties, where we believe in good faith that disclosure is necessary (i) to comply with applicable law, regulation, legal process or an enforceable governmental request; (ii) to enforce our Terms of Use or to investigate potential violations of them; (iii) to detect, prevent or address fraud, security or technical issues; or (iv) to protect the rights, property or safety of Nutgraf, our users or the public, as required or permitted by law.
Corporate transactions. We may disclose or transfer Personal Information to an actual or prospective acquirer, successor, investor or other counterparty, and to its advisors, in connection with an actual or proposed merger, acquisition, financing, reorganization, dissolution, bankruptcy, receivership or sale of all or part of our business or assets, including in the course of due diligence. In that event, to the extent we are able to do so, and in any event as required by applicable law (including, in a bankruptcy, 11 U.S.C. § 363(b)(1)), we will require the recipient to process your Personal Information consistently with this Privacy Policy and to give you notice and, where required by law, obtain your consent before using it in a materially different manner.
With your consent or at your direction. We may disclose Personal Information to other parties where you have directed us to do so or have consented to the disclosure.

We may also disclose aggregated statistics as described in Section 4.3. We do not disclose Personal Information to data brokers, advertising networks or social media platforms, and we do not permit third parties to use your email address to send you their own marketing.

7.No sale or sharing of Personal Information

We do not sell Personal Information, we do not share Personal Information for cross-context behavioral advertising, and we do not process Personal Information for targeted advertising, and we have not done any of these things since we began operating the Services. Except in connection with a corporate transaction described in Section 6, we do not rent, trade or otherwise make Personal Information available to third parties for monetary or other valuable consideration, and we do not disclose Personal Information to third parties for their own direct marketing purposes. We have no actual knowledge of selling or sharing the Personal Information of any individual under 16 years of age.

If we ever intend to change these practices, we will update this Privacy Policy before doing so and will provide any notice, right to opt out or opt-in consent mechanism required by Applicable Data Protection Law.

8.Cookies, similar technologies and browser signals

8.1 No cookies or tracking technologies on our website

Our website does not use cookies, local storage, session storage, web beacons, pixels, tags, software development kits, device fingerprinting or similar technologies that store information on your device or access information already stored on it, whether operated by us or by any third party. We do not use analytics, advertising, social media or session-replay tools on the website, we do not load scripts or embed content from third parties, and the fonts used on the website are served from our own hosting infrastructure rather than from a third-party font service. The confirmation that appears after you submit the waitlist form is displayed only during that visit and is not saved on your device. We do not permit third parties to collect Personal Information about your online activities over time and across different websites or online services through the Services. The technologies that may be used in our emails are described in Section 12.4.

If we decide to use cookies or similar technologies on our website in the future, we will update this Privacy Policy before doing so and will obtain your consent where required by Applicable Data Protection Law.

8.2 Do Not Track

Some browsers offer a “Do Not Track” setting that signals a preference not to be tracked across websites. Because we do not track visitors over time or across third-party websites, and do not permit third parties to do so through the Services, our practices are the same whether or not your browser sends a Do Not Track signal, and we take no additional action in response to one.

8.3 Global Privacy Control

Global Privacy Control (“GPC”) is a browser setting that communicates a request to opt out of the sale and sharing of Personal Information and of targeted advertising. Because we do not engage in any of those activities, every visitor is already treated as opted out of them, whether or not their browser sends a GPC signal. If we ever begin to engage in any of those activities, we will treat a GPC signal as a valid request to opt out for the browser or device that sends it, as required by Applicable Data Protection Law.

9.Data retention

We retain Personal Information only for as long as is reasonably necessary and proportionate to fulfill the purposes for which we collected it, as described in this Privacy Policy, unless a longer retention period is required or permitted by law. In determining retention periods, we consider the amount, nature and sensitivity of the Personal Information; the potential risk of harm from its unauthorized use or disclosure; the purposes for which we process it and whether we can achieve those purposes by other means; and applicable legal requirements and limitation periods. We apply these criteria as follows:

Personal Information	Retention
Waitlist email address	Until you unsubscribe, ask us to delete it or we discontinue the Waitlist and the newsletter, whichever occurs first. If we ask you to confirm your email address and you do not do so, only for as long as needed to manage the confirmation process. Thereafter, we keep your email address only as part of the consent and suppression records described below.
Browser type and signup and confirmation dates and times	Together with your Waitlist email address. After your email address is removed from the Waitlist, we keep a record of your signup and consent, and of any withdrawal of your consent, for as long as necessary to demonstrate our compliance with law, generally until the applicable limitation periods expire.
Suppression record	Your email address and the date of your unsubscribe or deletion request, for as long as we send emails to the Waitlist or to newsletter subscribers, so that we do not email you again.
Email delivery, engagement and unsubscribe records	For as long as we retain your Waitlist email address, and thereafter only as part of the suppression record. Copies held in our email service provider’s logs are kept under its log-retention settings.
Correspondence	For as long as reasonably necessary to respond to and resolve your message and to keep a record of our correspondence, taking into account applicable limitation periods.
Privacy request records	For as long as necessary to demonstrate our compliance with Applicable Data Protection Law (including, where the CCPA applies, for the 24 months after our response for which its regulations require such records to be kept), and longer only if, and for as long as, necessary to establish, exercise or defend legal claims.
Server log information, including IP addresses	Only as long as needed for security and troubleshooting, under our hosting provider’s log-retention settings, after which it is deleted automatically, except where we need it for longer to investigate a specific security incident or to comply with a legal obligation.

We may retain Personal Information beyond these periods where necessary to comply with a legal obligation, to respond to a legal hold or other legal process, or to establish, exercise or defend legal claims, in each case only for as long as necessary for that purpose. When Personal Information is no longer needed, we delete it or de-identify it. Residual copies may persist for a limited period in backup systems maintained by our Service Providers until they are overwritten in the ordinary course.

10.International data transfers

Nutgraf is a United States company. Our personnel may access Personal Information from the Republic of Azerbaijan, and our Service Providers may process Personal Information in the United States. As a result, your Personal Information may be transferred to, stored in and accessed from countries other than the one in which you live. Those countries may have data protection laws that differ from, and may be less protective than, the laws of your country, and Personal Information held in them may be accessible to the courts, law enforcement and national security authorities of those countries in accordance with their laws.

Countries. The countries to which we transfer Personal Information, or from which it may be accessed, are the United States and the Republic of Azerbaijan. If a Service Provider will process Personal Information in any other country, we will add that country to this Section before any Personal Information is transferred there.

Adequacy. The European Commission, the UK Government and the Swiss Federal Council have not recognized the Republic of Azerbaijan as providing an adequate level of data protection. Their adequacy decisions for the United States apply only to organizations certified under the EU-U.S. Data Privacy Framework, the UK Extension to it or the Swiss-U.S. Data Privacy Framework, respectively. Nutgraf is not certified under any of these frameworks.

Safeguards. Where Applicable Data Protection Law requires a transfer mechanism for a disclosure of Personal Information to a recipient in another country, we rely on a mechanism recognized by that law, such as the standard contractual clauses approved by the European Commission (supplemented, where applicable, by the UK International Data Transfer Addendum or adapted for transfers subject to the FADP), the recipient’s certification under one of the frameworks described above, or a derogation permitted by that law. Nutgraf personnel who access Personal Information from Azerbaijan do so on behalf of Nutgraf and subject to the safeguards described in Section 11. You may request further information about these safeguards, including a copy of any relevant contractual safeguards (which may be redacted to protect commercially sensitive information), by contacting us as described in Section 22.

11.Data security and breach notification

We maintain reasonable administrative, technical and organizational safeguards designed to protect Personal Information against accidental, unlawful or unauthorized access, use, alteration, disclosure, loss and destruction, appropriate to the nature of the Personal Information we hold and the risks presented by our processing. These safeguards include limiting the Personal Information we collect, restricting access to Personal Information to personnel and Service Providers who need it for the purposes described in this Privacy Policy, and engaging Service Providers that are required to implement security measures appropriate to the services they provide to us. No method of transmission over the internet and no method of electronic storage is completely secure, however, and we cannot guarantee the absolute security of your Personal Information. You can help protect your information by keeping your email account secure and by contacting us promptly if you believe that a message purporting to come from us is not genuine.

If we become aware of a breach of security that results in the accidental or unlawful destruction, loss or alteration of, or the unauthorized disclosure of or access to, your Personal Information, we will notify you, the competent supervisory authorities and other parties as required by Applicable Data Protection Law, within the periods it prescribes. Where we are required to notify you, we will generally do so by email.

12.Email communications

12.1 Your consent to our emails

The waitlist form displays the following notice immediately below the email field and the “Get early access” button: “By selecting ‘Get early access,’ you agree to our Terms of Use and to receive early access news and the Nutgraf newsletter. Unsubscribe anytime. See our Privacy Policy.” When you enter your email address and select “Get early access,” you consent to receive these emails from Nutgraf Intelligence, Inc. These emails are of two kinds: early access news, which comprises notifications and invitations relating to early access to, and the launch of, the Nutgraf product; and the Nutgraf newsletter, which may include news and updates about Nutgraf and the Nutgraf product. You may withdraw your consent at any time, free of charge, by unsubscribing as described in Section 12.2. Withdrawing your consent does not affect the lawfulness of emails sent before you withdrew it.

After you submit the waitlist form, we may ask you to confirm your email address by selecting a link in an email we send you. If we do, we will not send you early access news or the newsletter until you confirm, and we will record the date and time of your confirmation. We send our emails in accordance with the U.S. CAN-SPAM Act of 2003, Canada’s Anti-Spam Legislation and the other laws governing electronic marketing that apply to us. We do not send emails on behalf of third parties.

12.2 How to unsubscribe

You may unsubscribe from our emails at any time, free of charge, by:

selecting the unsubscribe link included in every email we send; or
emailing contact@nutgraf.ai and asking us to unsubscribe you. If you write from a different address, please tell us which address you wish to unsubscribe. Including the word “Unsubscribe” in the subject line helps us act on your request quickly, but it is not required.

We will give effect to your request promptly, and in any event within 10 business days after we receive it. To unsubscribe, you will never be required to provide any information other than your email address and your unsubscribe preference, or to take any step other than sending a reply email or visiting a single web page.

12.3 Sender identification

Each commercial email we send will accurately identify Nutgraf Intelligence, Inc. as the sender, will contain accurate header information and a subject line that is not misleading, and will include a valid physical postal address at which we receive mail, a functioning unsubscribe link and our contact email address.

12.4 Email engagement information

Depending on how it is configured, our email service provider may record whether and when you open an email we send you, by means of a small image (often called a pixel or web beacon) that your email application loads from the provider’s servers, and whether you select a link in it, by routing the link through the provider’s servers. When this occurs, the provider may also process your IP address and information about the device and email application you use. Where Applicable Data Protection Law requires your consent to the use of these technologies, we will not use them in emails sent to you without that consent. You can prevent open tracking by setting your email application not to load images automatically, and you can avoid click tracking by not selecting links in our emails; you may always unsubscribe by email instead, as described in Section 12.2.

12.5 After you unsubscribe

Because the Waitlist consists of the email addresses to which we send these emails, unsubscribing stops all early access news and newsletter emails and ends your participation in the Waitlist, unless we offer, and you select, more specific email preferences. We may send you a single message confirming your request, and we will retain a suppression record as described in Section 9 so that we do not email you again. We may still contact you where required by law, for example to notify you of a security incident affecting your Personal Information, or to respond to a request or message you send to us.

13.Your privacy rights and how to exercise them

13.1 Rights available to everyone

Wherever you live, and subject to the exceptions and limitations permitted by Applicable Data Protection Law, you may ask us to confirm whether we process your Personal Information; to give you access to it and a copy of it in a portable and, to the extent technically feasible, readily usable format; to correct it if it is inaccurate or incomplete; to delete it; and to stop sending you emails or otherwise withdraw any consent you have given. Depending on where you live, you may have additional rights, which are described in Sections 14 through 18.

We may decline or limit a request where permitted by Applicable Data Protection Law, for example where we cannot verify your identity, where the request is manifestly unfounded or excessive, or where we must retain information to comply with a legal obligation or to establish, exercise or defend legal claims. If we decline a request in whole or in part, we will explain why and, where Applicable Data Protection Law so requires, will inform you of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.

13.2 How to submit a request

You may submit a request by emailing us at contact@nutgraf.ai (the subject line “Privacy Request” will help us route it) or by writing to us at the postal address set out in Section 22, marked “Attn: Privacy.” Requests sent by mail may take several days longer to reach us; for the fastest response, please use email.

Please tell us the email address you used to join the Waitlist or to contact us, the right you wish to exercise and, so that we can apply the correct legal requirements, the country and, if applicable, the state or province in which you live. You do not need to create an account to submit a request. We do not charge a fee to process a request, unless Applicable Data Protection Law permits us to charge a reasonable fee (for example, for a manifestly unfounded or excessive request), in which case we will tell you before proceeding.

13.3 Verification

To protect your Personal Information, we must verify that a request has been made by the person to whom the Personal Information relates or by that person’s authorized agent. Because we hold very limited Personal Information and do not offer user accounts, we will generally verify a request by sending a message to the email address associated with your Personal Information and asking you to confirm that you made the request. Where necessary to verify a request for specific pieces of Personal Information, or where we have reason to doubt that a request is genuine, we may ask for limited additional information, such as the approximate date on which you joined the Waitlist. We will use information provided for verification only to verify your request and to keep a record of it. Requests to unsubscribe or to opt out do not require verification beyond what is necessary to identify the email address concerned.

13.4 Authorized agents

Where permitted by Applicable Data Protection Law, you may designate an authorized agent to submit a request on your behalf. Unless the agent holds a valid power of attorney under applicable law, we may require the agent to provide written permission signed by you, and we may require you to verify your identity directly with us or to confirm directly with us that you gave the agent that permission. We may deny a request from an agent that does not provide sufficient proof of its authority.

13.5 Timing of our response

We will confirm receipt of a request within any period required by Applicable Data Protection Law (for example, within 10 business days for requests under the CCPA), and we will respond within the period that law requires, which is generally one month under the GDPR and the UK GDPR, 30 days under the FADP and PIPEDA, 45 days under the CCPA and most other U.S. state privacy laws, and seven working days under the Law of the Republic of Azerbaijan on Personal Data, or, where no such period applies, within a reasonable time. Where Applicable Data Protection Law permits, we may extend the response period (for example, by up to two further months under the GDPR or by up to 45 additional days under the CCPA), in which case we will notify you of the extension and the reasons for it within the original response period. We will deliver our response by email unless you ask us to use another reasonable method.

13.6 Appeals

If we decline to take action on your request, in whole or in part, you may appeal our decision within a reasonable period after you receive it by replying to our response or by emailing contact@nutgraf.ai (the subject line “Privacy Request Appeal” will help us route it). We will review your appeal and inform you in writing of any action taken or not taken in response to it, together with a written explanation of the reasons for our decision, within the period required by Applicable Data Protection Law. If we deny your appeal, you may submit a complaint to the attorney general of your state or to another competent regulator. This appeal process is available to everyone.

13.7 Non-discrimination

We will not discriminate or retaliate against you for exercising any of your privacy rights. We will not deny you access to the Services, provide you with a different level or quality of service, or charge you a different price because you have exercised your rights, except that we cannot send you Waitlist emails after you have unsubscribed or asked us to delete your email address. Providing your email address is necessary for us to tell you about early access; we do not offer any payment, discount or other benefit in exchange for your Personal Information. If we ever do, we will provide any notice of financial incentive required by Applicable Data Protection Law before you choose to participate.

13.8 Complaints

You may make a complaint to us about our processing of your Personal Information at any time by contacting us as described in Section 22. We will acknowledge your complaint, investigate it and inform you of the outcome without undue delay, and in any event within any period required by Applicable Data Protection Law. You may also have the right to lodge a complaint with a data protection authority, as described in Sections 14, 17 and 18.

14.Additional information for the EEA, the UK and Switzerland

This Section applies if you are located in the EEA, the United Kingdom or Switzerland, or if the GDPR, the UK GDPR or the FADP otherwise applies to our processing of your Personal Information.

14.1 Your right to object

You may object at any time, free of charge and without giving reasons, to our processing of your Personal Information for direct marketing purposes, including the emails described in Section 12.1, in which case we will stop that processing. You may also object, on grounds relating to your particular situation, to any processing based on our legitimate interests, in which case we will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims. To object, use the unsubscribe link in any of our emails or contact us at contact@nutgraf.ai.

14.2 Your other rights

Subject to the conditions and exceptions set out in the GDPR, the UK GDPR or the FADP, as applicable, you also have the right to:

access your Personal Information and receive information about how we process it;
obtain the rectification of inaccurate or incomplete Personal Information;
obtain the erasure of your Personal Information;
obtain the restriction of our processing of your Personal Information;
receive the Personal Information you provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller where technically feasible;
withdraw your consent at any time, where we rely on consent, without affecting the lawfulness of processing based on consent before its withdrawal; and
not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you, although, as stated in Section 4.2, we do not make such decisions.

You may exercise these rights as described in Section 13.

14.3 Switzerland

If the FADP applies, you have, in particular, the right to request information about whether and how we process your Personal Information, to request its correction or deletion, to object to its processing, and to request the release or transfer, in a commonly used electronic format, of Personal Information you have provided to us. The countries to which we disclose Personal Information are identified in Section 10.

14.4 Complaints to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country in which you live or work or in which an alleged infringement took place. A list of supervisory authorities in the EEA is available on the website of the European Data Protection Board (edpb.europa.eu). In the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ico.org.uk), and in Switzerland it is the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We encourage you to contact us first so that we can try to address your concern.

15.Additional information for California residents

This Section supplements the rest of this Privacy Policy and applies to residents of California. We provide the disclosures in this Section, and honor the requests it describes, whether or not the CCPA applies to us. Terms used in this Section that are defined in the CCPA have the meanings given to them in the CCPA.

15.1 Notice at collection

The table below describes the categories of Personal Information that we collect, and that we have collected in the preceding 12 months (or since we began operating the Services, if shorter); the sources from which we collect them; the business or commercial purposes for which we collect and use them, by reference to Section 4.1; the categories of recipients to which we disclose them for a business purpose; and how long we retain them. We do not sell or share any category of Personal Information.

Category	Personal Information	Sources	Purposes	Disclosed for a business purpose to	Retention
Identifiers	The email address you submit to the Waitlist or from which you contact us; IP addresses processed by our hosting provider or email service provider, or contained in the header of an email you send to us; your name, if you include it in a message to us	You; your browser and device, through our hosting provider and email service provider	Section 4.1(a) through (e) and (g) through (j)	Service Providers (hosting, email service and email hosting providers); professional advisors; public authorities, where required by law	Waitlist email address: until you unsubscribe, ask us to delete it or we discontinue the Waitlist, then only in our consent and suppression records. IP addresses: as long as needed for security and troubleshooting. Correspondence: as long as reasonably necessary. See Section 9.
Personal information described in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Your name and any other such information you choose to include in a message to us	You	Section 4.1(g) through (j)	Service Providers (email hosting provider); professional advisors; public authorities, where required by law	As long as reasonably necessary to respond to your message and to keep a record of our correspondence. See Section 9.
Internet or other electronic network activity information	Browser type (user-agent string) and signup and confirmation dates and times; server log information processed by our hosting provider, such as the pages requested, the date and time of requests and referring addresses; email delivery, engagement and unsubscribe records	Your browser and device; our hosting provider and email service provider	Section 4.1(a) through (f) and (h) through (j)	Service Providers (hosting and email service providers); professional advisors; public authorities, where required by law	Browser type and signup and confirmation times: with your Waitlist email address, then in our consent records. Server logs: as long as needed for security and troubleshooting. Email records: as long as we retain your email address. See Section 9.

We do not collect Personal Information in any other category identified in the CCPA, such as characteristics of protected classifications, commercial information, biometric information, geolocation data, audio or visual information, professional or employment-related information, education information or inferences drawn to create a profile about you, except to the extent that you choose to include such information in a message to us.

15.2 Sale, sharing and Sensitive Personal Information

As stated in Section 7, we do not sell or share Personal Information, we have not done so in the preceding 12 months, and we have no actual knowledge of selling or sharing the Personal Information of consumers under 16 years of age. We do not collect or process Sensitive Personal Information for the purpose of inferring characteristics about consumers, and we do not use or disclose it for any purpose that would give rise to a right to limit its use under the CCPA. Accordingly, we do not offer a “Do Not Sell or Share My Personal Information” link or a “Limit the Use of My Sensitive Personal Information” link.

15.3 Your California privacy rights

Subject to the exceptions in the CCPA, California residents have the right to:

know the categories of Personal Information we have collected about them, the categories of sources from which it was collected, the business or commercial purposes for collecting it, and the categories of third parties to which we have disclosed it, and access the specific pieces of Personal Information we have collected about them;
request the deletion of Personal Information we have collected from them;
request the correction of inaccurate Personal Information we maintain about them;
opt out of the sale or sharing of their Personal Information and limit the use and disclosure of their Sensitive Personal Information, although, as stated in Section 15.2, we do not engage in the activities to which these rights apply; and
not receive discriminatory treatment for exercising any of these rights.

To exercise these rights, please follow the process described in Section 13, which also explains how we verify requests and how you may use an authorized agent. We accept requests by email and by mail.

15.4 California “Shine the Light” law

California Civil Code Section 1798.83 permits California residents to request certain information regarding a business’s disclosure of personal information to third parties for those third parties’ direct marketing purposes. We do not make such disclosures. You may direct any questions about this to contact@nutgraf.ai or to the postal address set out in Section 22.

16.Additional information for residents of other U.S. states

16.1 State consumer privacy rights

Residents of certain U.S. states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and of other states that have enacted comprehensive consumer privacy laws, may have, depending on their state of residence and subject to the exceptions in the applicable law, the rights described in Section 13.1; the right to opt out of the processing of their Personal Information for targeted advertising, its sale, or profiling in furtherance of decisions that produce legal or similarly significant effects; in certain states, the right to obtain a list of the specific third parties, or of the categories of third parties, to which we have disclosed their Personal Information; and the right to appeal our decision regarding a request, as described in Section 13.6.

As described in Sections 4.2 and 7, we do not sell Personal Information, process it for targeted advertising or engage in profiling in furtherance of decisions that produce legal or similarly significant effects. As described in Section 3.5, we do not request or intentionally collect Sensitive Personal Information, and we use any that you choose to include in a message to us only to respond to you and to keep a record of our correspondence. To exercise your rights or to appeal a decision, please follow the process described in Section 13. We honor these requests whether or not a particular state law applies to us.

16.2 Nevada

Chapter 603A of the Nevada Revised Statutes permits Nevada consumers to direct the operator of a website not to sell covered information that the operator has collected or will collect about them. We do not sell covered information, as “sale” is defined under Nevada law. You may nevertheless submit such a direction by emailing contact@nutgraf.ai (the subject line “Nevada Do Not Sell Request” will help us route it), and we will respond to a verified request within 60 days after we receive it, or within any extended period permitted by Nevada law. You may review and request changes to your Personal Information as described in Section 13, and we will notify you of material changes to this Privacy Policy as described in Section 21.

17.Additional information for Canada

If you are located in Canada, we process your Personal Information in accordance with PIPEDA and, where applicable, provincial private-sector privacy laws. When you join the Waitlist, you consent to our collection and use of your email address, browser type and signup date and time to send you the emails you requested and for the related purposes described in Section 4.1, and to our disclosure of that information to our Service Providers, including outside Canada, as described in Sections 6 and 10. Subject to applicable law, you may request access to the Personal Information we hold about you, challenge its accuracy and completeness and have it amended as appropriate, and withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw your consent, we will no longer be able to send you our emails.

Our founder is the individual accountable for our compliance with this Privacy Policy and with Canadian privacy laws and, where Quebec’s Act respecting the protection of personal information in the private sector applies, is the person in charge of the protection of personal information. You may contact that individual at contact@nutgraf.ai or at the postal address set out in Section 22, marked “Attn: Privacy.” As described in Section 10, your Personal Information will be processed outside Canada, in the United States, Azerbaijan and any other country listed in that Section, where it may be accessible to the courts, law enforcement and national security authorities of those countries under their laws. You may also file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where applicable, the privacy regulator of your province.

18.Additional information for Azerbaijan

If you are located in the Republic of Azerbaijan, or if the Law of the Republic of Azerbaijan on Personal Data otherwise applies to our processing of your Personal Information, you have the rights provided by that law. Subject to its conditions, these include the right to know whether we process your Personal Information, the legal basis and purposes of that processing and the sources of the information; to access your Personal Information; to require us to correct, block or destroy Personal Information that is inaccurate, incomplete or processed unlawfully; to withdraw your consent to processing; and to seek protection of your rights, including by applying to the competent state authority or to a court. You may exercise these rights as described in Section 13. If we refuse a request under that law, we will give you a reasoned response within five working days after we receive the request.

Your Personal Information will be transferred to and stored in the United States and any other country listed in Section 10, whose laws may not provide a level of protection equivalent to that required by the Law of the Republic of Azerbaijan on Personal Data. If you are located in the Republic of Azerbaijan, please submit the waitlist form only if you consent to that transfer; by submitting it after being informed of the transfer in this Section, you give that consent. You may withdraw your consent at any time as described in Section 12.2, in which case we will delete your Personal Information, except for the consent and suppression records described in Section 9.

19.Children’s privacy

The Services are intended for adults who are able to enter into a binding contract with us, as described in our Terms of Use, and are not directed to individuals under the age of 18. We do not knowingly collect Personal Information from anyone under 18 and, consistent with the U.S. Children’s Online Privacy Protection Act, we do not knowingly collect Personal Information from children under 13. If you are under 18, please do not join the Waitlist or send us any Personal Information.

If we learn that we have collected Personal Information from an individual under 18, we will delete it promptly. If you are a parent or legal guardian and believe that your child has provided Personal Information to us, please contact us as described in Section 22, and we will delete it. The Services do not allow users to post content publicly.

20.Third-party websites and services

The Services, including our emails, may contain links to websites, applications and services operated by third parties. This Privacy Policy does not apply to them, and we are not responsible for their content or privacy practices. Information you provide to a third party is governed by that third party’s privacy policy, which we encourage you to review.

21.Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services or applicable law. When we do, we will post the revised version on this page and update the “Last updated” date at the top. If we make material changes, we will notify you before they take effect, by email (if you are on the Waitlist) or by a prominent notice on the Services, and we will obtain your consent where required by Applicable Data Protection Law. We will not apply a material change to Personal Information collected under a prior version of this Privacy Policy in a way that is less protective of that information without your consent.

22.Contact us

If you have any questions, concerns or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise your rights, please contact us at:

Nutgraf Intelligence, Inc.
Attn: Privacy
c/o Legalinc Corporate Services Inc.
131 Continental Drive, Suite 305
Newark, DE 19713
United States
contact@nutgraf.ai

If you have a disability and need this Privacy Policy in an alternative format, please contact us at contact@nutgraf.ai, and we will work with you to provide it in a format that meets your needs.