GLOBAL PRIVACY POLICY

The Third Network – Augmented Autonomous Human Mesh / “Every Human is a Service”™ · the “Sovereign Data Constitution”

Controller / Operator: AAHM Technologies Inc. (“AAHM,” “we,” “us”), Registered Seat: Florida, USA

Privacy contact / DPO: privacy@aahm.technology | dpo@aahm.technology | Security: security@aahm.technology

We aim to be a transparency document first and a contract second. This Policy explains what personal data the Third Network collects, why, how long we keep it, who we share it with, how we protect it, and the rights you have. Capitalised terms not defined here have the meaning in the Master Terms.

Contents

1. Purpose and Approach

2. Who This Policy Applies To (Role-Based Application)

3. Key Definitions

4. Data We Collect and Sources

5. Why We Process Data, Legal Bases, and Cookies

6. How AI Processing and Model Training Work

7. Consent and the Data-Licensing / Royalty Program

8. How We Share Data, and Our Sub-processors

9. International Data Transfers

10. Security and Data Breach Notification

11. Data Retention

12. Your Rights and Data Export

13. Anonymization and Training Vectors (Honest Treatment)

14. Role-Specific Notices

15. Children’s Privacy

16. Regional Disclosures

17. Conflict and Local-Law Savings Clause (Critical)

18. Dispute Resolution (as Applied to Privacy)

19. Force Majeure, Changes, Severability, and Contact

Exhibit A – Biometric & AI-Training Consent

Exhibit B – Sub-processors

1. Purpose and Approach

This Policy works alongside our Terms and Conditions and any signed Data Processing Agreement (DPA) or Order Form. Where a negotiated enterprise agreement, DPA, or Order Form conflicts with this Policy, the negotiated agreement controls for that customer. Nothing in this Policy removes rights you have under the mandatory laws of your country or state of residence; the Conflict and Local-Law Savings Clause (§17) governs any conflict between this Policy and those laws.

2. Who This Policy Applies To (Role-Based Application)

The Third Network serves four roles. Your rights, the legal basis for processing, and whether AAHM is a controller or a processor depend on your role – this distinction is central to how the law applies to you.

Role | Who you are | AAHM’s data-protection role | Governing document

Seeker | Individual consumer requesting human judgment / a session | Controller of your account, identity, and session data | This Policy + Seeker Notice (§14.1)

Expert | Independent professional offering expertise | Controller of your account, identity, and contributed data; licensee of data you elect to license for training | This Policy + Expert Notice (§14.2)

Business | Self-serve commercial customer routing its own users through the Network | Processor on the Business’s instructions for that customer data; controller of the Business’s own account data | This Policy + Standard DPA (§14.3)

Enterprise | Negotiated commercial customer | Processor under a signed MSA + DPA + Order Form | MSA + DPA (controls over this Policy)

Controller vs. processor, briefly. When AAHM decides why and how data is processed (e.g., your own account and identity data), AAHM is a controller and is directly responsible to you. When a Business or Enterprise customer routes their end-users’ data through the Network and decides the purpose, AAHM acts as a processor on that customer’s documented instructions, and the customer is the controller. Processing in the processor role is governed by the DPA (§14.3), not by AAHM’s discretion.

3. Key Definitions

• Personal Data / Personal Information – any information relating to an identified or identifiable individual, as defined by applicable law.

• Processing – any operation performed on personal data (collection, use, storage, disclosure, deletion, etc.).

• Input – data you or a Business submit to the Network to obtain a result (a matched Expert, a routed session, an answer).

• Output – the result the Network returns in response to an Input.

• Service Functionality Data – data used solely to operate a live session, match users, verify identity, and run the platform.

• Model-Training Data – data used to train, fine-tune, evaluate, or improve AAHM’s own models, only where a lawful basis (consent or a valid licence for licensed data) exists.

• Anonymized Data – data irreversibly altered so that no individual can be identified by AAHM or anyone else by reasonable means; it falls outside data-protection law. “De-identified,” “tokenized,” or “pseudonymized” data that can still be linked to a person is NOT anonymized and remains personal data subject to this Policy.

• Biometric Data – voiceprints, facial geometry, eye-tracking, keystroke dynamics, and behavioral characteristics that can identify an individual.

• Sub-processor – a third party AAHM engages to process personal data on its behalf (Exhibit B).

• “Sale” / “Share” – have the meanings given by US state privacy laws; see §8 for our position (we do not sell or share for cross-context behavioral advertising).

4. Data We Collect and Sources

We collect only what we need for the purpose described next to it, directly from you, automatically through your use of the Network, from Business/Enterprise customers who route data to us as controllers, and from service providers such as Stripe (payment status) and fraud/identity vendors.

Category | Examples | Purpose

Identity & account | Name, business registration, public keys, signatures, jurisdiction, email, consent/clickwrap timestamps; identity/KYC data | Account creation, access control, fraud prevention, compliance verification. KYC is for fraud and payment/tax compliance only – not a background or fitness check (Terms §8.4)

Expert profile & tax | Profile text, stated qualifications, ratings/reviews; for reportable sellers, DAC7/OECD tax data (TIN, address, DOB or registration no., financial-account identifiers) | Operate Expert profiles; meet platform tax-reporting obligations (§5; Terms §28)

Payment | Processed by Stripe; AAHM receives limited transaction metadata, not full card numbers | Billing, payouts, fee integrity (Stripe processes under its own terms)

Session / routing | Text, code, queries, answers, and analyses routed during active sessions | Matching, indexing, and real-time transmission between Seekers/Businesses and Experts

Biometric & media (opt-in only – §7) | Voice, video, facial geometry, eye-tracking, keystroke and behavioral patterns | Real-time multimodal sessions, identity verification, and – only with separate consent – model training

Transactional | Transaction records, escrow logs, token IDs, timestamps, routing logs | Accounting, fee integrity, royalty calculation, dispute resolution

Technical & telemetry | IP address, device/configuration data, latency and diagnostic metrics, cookies | Security, uptime, abuse prevention, pipeline optimization

Derived | De-identified vectors, embeddings, aggregated statistics, analytics AAHM generates | Operate, secure, and improve the Network (Terms §10.6)

We do not intentionally collect special-category data (health, biometric-for-ID, etc.) except where you knowingly provide it and have given any separate consent the law requires. We do not seek criminal-history or background-check data, and we do not knowingly collect data from children (§15).

5. Why We Process Data, Legal Bases, and Cookies

Where the GDPR, UK GDPR, or a comparable regime applies, we rely on these bases (GDPR Art. 6; Art. 9 for special categories):

• Performance of a contract (Art. 6(1)(b)) – to operate matching, route sessions, run accounting, and deliver the service you requested.

• Legitimate interests (Art. 6(1)(f)) – to secure the Network, prevent fraud and off-platform circumvention, and maintain records, balanced against your rights; you may object (§12).

• Consent (Art. 6(1)(a); Art. 9(2)(a) for biometrics) – for biometric processing (§7), with identity never sold; for Experts, training AAHM’s own engine on de-identified data and licensing that AAHM-owned data to third parties are necessary for performance of the Expert agreement (Art. 6(1)(b); Master Terms §10.3a); freely given and revocable at any time without penalty to core service.

• Legal obligation (Art. 6(1)(c)) – to comply with tax and platform-reporting (DAC7/OECD), accounting, sanctions/OFAC, and lawful requests.

For US state laws (CCPA/CPRA, FDBR, TDPSA, VCDPA, CPA, UCPA, CTDPA and others) and biometric statutes (BIPA, CUBI, Washington My Health My Data), we process consistent with the applicable purpose-limitation, notice, and consent requirements and honour the rights in §12.

5.5 Cookies and similar technologies. We use strictly necessary cookies to run the service and, with consent where required, analytics/preference cookies. You can manage non-essential cookies through our cookie banner or your browser, and we honour recognised opt-out signals (e.g., Global Privacy Control) where required by law.

6. How AI Processing and Model Training Work

This section reflects our most important commitments and replaces any prior “irrevocable training licence” framing.

6.1 Input/Output, not silent training. Data you submit becomes an Input used to generate an Output. Operating the service for you is separate from training our models. We do not treat your Inputs as Model-Training Data by default.

6.2 Third-party providers and third-party supply. Two different things are kept distinct here. First, where the Network uses third-party large language models or compute providers to deliver functionality to you, those providers are contractually prohibited from using your data to train or fine-tune their own models, and are bound to zero- or limited-retention terms in our DPAs with them. Second, AAHM may license the de-identified or Anonymized data it owns and derives from contributions, under §13 and Master Terms §10.7, to third-party AI laboratories and researchers for AI development and research; this AAHM-owned data does not require a separate contributor opt-in. We never sell your personal data or biometric identity data, and every recipient is bound by a written Data Licensing Agreement prohibiting re-identification and onward resale (§8.4).

6.3 AAHM model training is consent- or licence-based. We train, fine-tune, and improve our own models – including the self-learning Lucha routing engine and any “Digital Legacy / Wisdom-as-a-Software” feature – only on (a) data you have separately opted in to contribute (§7) or, for Experts, de-identified contribution data covered by the mandatory engine-training commitment in Master Terms §10.3a, (b) data an Expert has expressly licensed for training, or (c) genuinely Anonymized Data. We do not train on Business/Enterprise customer data except as their DPA permits.

6.4 Sensitive-data redaction at ingestion. Before any data enters a training pipeline, it passes through automated redaction designed to remove direct identifiers and sensitive data (personal identifiers, health, and financial details) by default. Redaction reduces but does not eliminate risk; training only proceeds on the redacted stream.

6.5 AI transparency (EU AI Act Art. 50 and comparable). Where you interact with an AI system on the Network – including automated matching, the Lucha routing engine, or AI-assisted responses – we disclose that at the start of the interaction and label AI-generated or AI-assisted output where required. We do not rely solely on this Policy to satisfy that obligation (Master Terms §30).

6.6 Automated decision-making (GDPR Art. 22). Algorithmic matching may involve automated processing. Where a decision produces legal or similarly significant effects on you, you have the right to obtain human review, express your view, and contest the decision (§12).

7. Consent and the Data-Licensing / Royalty Program

We have deliberately separated privacy consent from compensation so that consent remains legally valid (“freely given”).

7.1 Biometric and training consent is independent and free to withdraw. Voice, video, and biometric processing each require your separate, affirmative opt-in (Exhibit A). Use of your data to train AAHM’s own models likewise requires your opt-in, except that for Experts this own-engine training is a mandatory condition of the Expert role (Master Terms §10.3a) agreed at onboarding rather than an optional opt-in. You may withdraw biometric and other optional consents in Settings → Privacy, and an Expert may end own-engine training only by closing the Expert account (future use stops; already-Anonymized data cannot be recalled). Withdrawal: stops new collection/processing for that purpose going forward; triggers deletion of raw biometric inputs within 30 days (§11); does not disable core, non-biometric service; and is not penalized. Some advanced multimodal features that technically require biometrics may become unavailable, but withdrawing consent never reduces access to features that do not depend on the withdrawn data.

7.2 The Data-Licensing / Royalty Program is a separate commercial election. Experts earn royalties for the de-identified contribution data used to train AAHM’s own engine under the Expert role (§7.1; Master Terms §10.3a), and the same AAHM-owned de-identified data may also be licensed to third parties for additional royalties (§11.5) without a separate opt-in. Biometric processing and use of identifiable identity data remain opt-in (§7.1), and identity is never sold. None of this is a condition of using the core platform and are not a substitute for the privacy consent in §7.1. Royalty mechanics are governed by the Terms (§11) and the program’s own terms. Declining or later leaving the Program affects only future royalty eligibility for newly licensed data; royalties already earned and payable remain payable, and it does not affect your privacy rights, your account, or core service. Third-party licensing of the de-identified or Anonymized data AAHM owns earns royalties per Master Terms §11.5 and does not require a separate opt-in; it does not affect core service, and your biometric and identity choices remain separately opt-in.

7.3 Pre-ingestion opt-out is meaningful. Because withdrawing consent before data is anonymized still allows deletion, we give you a genuine opportunity to opt out before contributed data is incorporated into training (§13).

8. How We Share Data, and Our Sub-processors

8.1 No sale; no behavioral-ad sharing. We do not sell your personal data or biometric identifiers, and we do not “share” it for cross-context behavioral advertising as those terms are defined under US state privacy laws.

8.2 We share data only with:

• Sub-processors (payment – Stripe; cloud hosting; compute/TPU providers; security and analytics vendors) bound by written DPAs that require confidentiality, security, purpose limitation, and deletion on instruction. A current list is in Exhibit B.

• Other users, only as needed to deliver a connection (e.g., an Expert sees a Client’s request).

• Legal, tax, and regulatory authorities, only where required by valid legal process or law (including DAC7/OECD reporting), and we notify you where lawfully permitted.

• Successors-in-interest, in a merger/acquisition/financing, where the successor is bound by commitments no less protective than this Policy and Exhibit A.

8.3 Business/Enterprise (processor) sharing is governed by the customer’s DPA and instructions, not by this Section. For enterprise deployments where a customer extracts and commercialises deployment data, that customer is an independent controller responsible for its own lawful basis and opt-outs (Master Terms §§20.6 to 20.7), the deployment is operated under and configured for the customer’s jurisdiction, and that collection is governed by the customer’s own notice and the DPA Enterprise-Deployment Schedule rather than by this Policy.

8.4 Third-party AI research and data supply. Where you have given the separate Third-Party-Supply election (Exhibit A of the Master Terms), or where data is genuinely Anonymized under §13, we may license human-expertise datasets to third-party AI laboratories and researchers. What we license is de-identified or Anonymized human-expertise data, never your identity: we do not include direct identifiers or biometric identity data, and we do not sell personal information as those terms are defined under US state privacy law. Recipients are bound by a written Data Licensing Agreement that limits use to the licensed purpose, prohibits any attempt to re-identify an individual, and prohibits reselling the data as data. For data that remains de-identified personal data rather than genuinely Anonymized, your access, deletion, and objection rights continue to apply and we honor them, and withdrawing the election stops future supply (data already Anonymized and already supplied cannot be recalled, §13).

9. International Data Transfers

The Network operates across the United States, Singapore, and other regions, so personal data may be transferred internationally. Where we transfer personal data across borders we use a lawful mechanism:

• From the EEA / UK / Switzerland: EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum; or reliance on an adequacy decision or the EU – US / UK / Swiss Data Privacy Framework where applicable – together with a transfer-risk assessment and supplementary measures where needed.

• From other regions: the equivalent mechanism required by local law (e.g., India DPDP, Brazil LGPD, Canada PIPEDA).

We will identify the specific mechanism on request to privacy@aahm.technology. Data location follows deployment: the AAHM platform and United States deployments operate in the United States, and deployments serving other jurisdictions are operated under, and configured for, those jurisdictions, including any data-residency and cross-border-transfer requirements that apply there (Master Terms §20.7).

10. Security and Data Breach Notification

We maintain administrative, technical, and physical safeguards designed to protect personal data, session content, and biometric data, including: encryption in transit (TLS) and at rest (AES-256 or equivalent); least-privilege access controls with logging and monitoring; logical segregation of customer data; a security program aligned to recognised standards (targeting/maintaining SOC 2 Type II and ISO 27001 – confirm current status before publishing); and vendor due-diligence with security flow-downs to sub-processors.

Breach notification. If a personal-data breach occurs, we act without undue delay: as controller, we notify the competent supervisory authority where required (under GDPR/UK GDPR, generally within 72 hours of becoming aware) and notify affected individuals where there is a likely high risk; as processor, we notify the relevant controller without undue delay so it can meet its deadlines; and we provide notices required by US state breach laws (including the Florida Information Protection Act) and other regimes (GDPR Arts. 33 – 34; Master Terms §27). Safeguard your credentials and report concerns to security@aahm.technology. No system is perfectly secure; we do not guarantee absolute security.

11. Data Retention

Data | Retention | Then

Raw media & un-vectorized biometrics | Duration of session + max 30 days | Permanent deletion / cryptographic shredding

Biometric identifiers (BIPA-style schedule) | Until purpose satisfied or 3 years since last interaction, whichever is first | Permanent destruction unless law/subpoena/dispute requires longer

Account & identity data | Life of account + limited wind-down period | Deletion or anonymization

Transactional / financial / tax (incl. DAC7) | As required by law (commonly up to 7 years) | Deletion

Anonymized training vectors | Indefinite only if genuinely anonymized (§13) | Retained as non-personal data

Data under legal hold | Until the matter is finally resolved | Released to the normal schedule

We retain personal data no longer than necessary for the purpose collected or as law requires. Our biometric retention-and-destruction schedule is published to satisfy Illinois BIPA and comparable laws (Exhibit A).

Drafting note. The biometric “purpose-satisfied-or-3-years” line is the BIPA-required, publicly posted destruction schedule – the prior drafts had the 30-day raw-deletion rule but not the BIPA written schedule. Both are kept. Confirm the windows match operational reality before posting.

12. Your Rights and Data Export

Subject to your jurisdiction, you may have the right to: access your data; correct it; delete it; restrict or object to processing; port/export it in a machine-readable format (including on account closure – Master Terms §18.2); withdraw consent at any time (without affecting prior lawful processing); opt out of sale/share/targeted advertising and of certain profiling; limit the use of sensitive personal information; obtain human review of significant automated decisions; and not be discriminated against for exercising these rights.

To exercise rights, use Settings → Privacy or contact privacy@aahm.technology; we respond within the period the law requires (generally 30 – 45 days) and may verify your identity first. You always retain the right to lodge a complaint with your data-protection or consumer authority and to a judicial remedy. No provision of this Policy or the Terms waives that right, and exercising statutory data-protection rights is not subject to the contractual liability caps, the one-year limitation period, the class-action waiver, or the arbitration provisions in the Terms (§17). We honour Global Privacy Control where required and do not sell the personal information of anyone we know to be under 16 without opt-in.

13. Anonymization and Training Vectors (Honest Treatment)

We previously described training vectors as permanently irrecoverable and beyond deletion. The accurate position is:

• If contributed data is genuinely Anonymized (no individual identifiable by reasonable means), it falls outside data-protection law and may be retained as non-personal data. We commit to a recognised anonymization standard and document our method.

• If data is only de-identified, tokenized, or pseudonymized and can still be linked to you, it remains personal data and your deletion, access, and objection rights continue to apply – and we will honour them.

• Because removing an individual contribution from already-trained model weights may be technically infeasible, we give you a meaningful pre-ingestion opt-out (§7.3) and only proceed to anonymized integration after that window. Where law (e.g., GDPR Art. 17) nonetheless requires action on data still classed as personal, we will comply.

Drafting note. This “honest treatment” section is one of the strongest parts of the source drafts and is kept verbatim in substance: claiming vectors are “beyond deletion” is a regulatory red flag, whereas distinguishing genuinely-anonymized from merely-pseudonymized data and offering a real pre-ingestion opt-out is what holds up under GDPR.

14. Role-Specific Notices

14.1 Seeker (Consumer) Notice. You are an individual consumer. AAHM is the controller of your account, identity, and session data. We rely on contract and (for biometrics/training) consent. You keep all mandatory consumer and data-protection rights in your home country; the Savings Clause (§17) ensures those prevail over any conflicting term. Mandatory pre-dispute arbitration, class-action waivers, and liability caps do not apply to you to the extent your local consumer law prohibits them.

14.2 Expert Notice. You are an independent professional. AAHM is the controller of your account/identity data and a licensee only of data you separately elect to license (§7.2). Your data-protection rights are unaffected by your independent-contractor status. Any model-training use of your data requires the separate consent or licence in §7; it is never a condition of network access. Tax, social-security, and worker-classification matters are addressed in the Terms and the Expert Agreement, not here, and are governed by the mandatory law of where you work.

14.3 Business and Enterprise (Processor) Notice. When you route your own users’ or customers’ personal data through the Network, you are the controller and AAHM is your processor. That processing is governed by our Data Processing Agreement, which: limits AAHM to processing on your documented instructions; incorporates SCCs/UK Addendum for transfers; lists sub-processors and provides a change-notification mechanism; sets out security measures, breach notification, audit support, and deletion/return on termination; and, for US state laws, prohibits AAHM from selling/sharing your data or using it outside the service relationship. Enterprise customers may negotiate data residency, additional security exhibits, and liability terms in the MSA, which controls over this Policy.

15. Children’s Privacy

The Network is intended for adults (18+ per the Terms) and is not directed to children. We do not knowingly collect personal data from children under 16 (or the higher age set by local law), or under 13 in the US under COPPA. If we learn we have, we will delete it. Businesses must not route children’s data through the Network without a lawful basis and any required parental consent.

16. Regional Disclosures

• EEA / UK / Switzerland: Controller and representative details are at the top of this Policy; legal bases in §5; transfer mechanisms in §9; you may complain to your supervisory authority. Art. 22 and Platform-to-Business transparency are described in Master Terms Schedule E.

• United States (California and other states): Categories collected, purposes, and your access/deletion/correction/opt-out and “limit sensitive PI” rights are described above; we honour Global Privacy Control where required; we do not sell or share personal data as defined by those laws; Florida residents have rights under the FDBR.

• Illinois / Texas / Washington (biometrics): See Exhibit A for BIPA / CUBI / My Health My Data consent, retention, and destruction commitments.

• India (DPDP), Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act): We process on a valid legal basis, honour data-principal/holder rights, and use lawful transfer mechanisms.

17. Conflict and Local-Law Savings Clause (Critical)

17.1 To the extent any provision of this Policy or the Terms conflicts with a mandatory consumer-protection, employment/worker-classification, or data-protection law applicable to a particular user based on residence, place of work, or the targeting of services to their jurisdiction, that mandatory law prevails for that user, and the conflicting provision is modified or suspended only as to that user and only to the minimum extent necessary.

17.2 Statutory data-protection rights – including the right to lodge a complaint with a supervisory authority and the right to a judicial remedy – cannot be waived and are not subject to the contractual liability caps, the one-year limitation period, the class-action waiver, or the mandatory-arbitration provisions in the Terms, where the applicable law so requires.

17.3 The remainder of this Policy continues in full force. This clause prevails over any contrary “blue-pencil,” severability, or governing-law provision.

18. Dispute Resolution (as Applied to Privacy)

Privacy disputes are handled under the dispute-resolution provisions of the Terms (§17 of the Master Terms – JAMS/Delaware for North America; SIAC/Singapore for other regions), except that, per §17 above, nothing strips any individual of: (a) the right to complain to a data-protection authority; (b) any non-waivable judicial remedy; or (c) consumer rights that local law makes non-arbitrable. The good-faith consumer carve-out for claims under USD $10,000 in the Terms also applies here, as do the internal complaint and appeal processes in Master Terms §31.

Drafting note. Source drafts pointed to “Section 7 of the Terms” for arbitration; in our Master Terms v3.0 arbitration is §17, so the cross-reference is corrected here.

19. Force Majeure, Changes, Severability, and Contact

19.1 Force majeure. We are not liable for data loss or unavailability caused by events genuinely beyond our reasonable control, except to the extent applicable data-protection law imposes non-excludable obligations, which we will still meet.

19.2 Changes. We post material changes here and, where required, notify you in advance and obtain any necessary fresh consent; changes are not retroactive and the “Last Updated” date reflects the current version.

19.3 Severability. If any provision is held invalid, it is reformed to the minimum extent needed to be valid while preserving intent; the rest remains in effect, subject always to §17.

19.4 Contact. Privacy questions and rights requests: privacy@aahm.technology; DPO: dpo@aahm.technology.

Exhibit A – Biometric & AI-Training Consent

This consent is separate from the Terms, freely given, and revocable.

1. What we collect (only if you opt in). Voiceprints, facial geometry, eye-tracking, keystroke dynamics, and behavioral characteristics (“Biometric Data”).

2. Why. (a) Service functionality – real-time multimodal sessions and identity verification; and (b) AI training (separate toggle) – to improve AAHM’s own models, including the Lucha engine, on redacted/anonymized data only, never for third-party LLM training.

3. Retention. Raw biometric inputs deleted within 30 days of session end; biometric identifiers destroyed when the purpose is satisfied or within 3 years of your last interaction, whichever is first (§11); genuinely anonymized vectors may be retained as non-personal data (§13); financial/legal-hold exceptions per §11.

4. Sharing. No sale; sub-processors under DPAs; legal authorities only on valid process; bound successors.

5. Your rights. Withdraw any consent at any time in Settings → Privacy; we stop new processing and delete raw Biometric Data within 30 days. Withdrawal does not disable features that do not require biometrics and does not reduce non-biometric service, and affects only future royalty eligibility for newly licensed data (§7.2). Access/delete via privacy@aahm.technology (30-day response).

6. Statutory consent (where applicable). BIPA (740 ILCS 14/15), Texas CUBI (§503.001), Washington My Health My Data Act, GDPR Art. 9(2)(a), India DPDP §7, Florida Digital Bill of Rights. You understand your data may be processed in the United States and Singapore under the transfer mechanism in §9.

[ ] I CONSENT to biometric processing for SERVICE FUNCTIONALITY.

[ ] I CONSENT (separately) to use of my data to train AAHM’s own models.

[ ] I DECLINE biometric processing. (Voice/video features that require it will be unavailable; all other service remains fully available.)

Name: ____________________ Date: ____________ Signature / Clickwrap Timestamp: ____________________

Withdrawing consent does not retroactively invalidate processing that was lawful before withdrawal.

Exhibit B – Sub-processors

Sub-processor | Service | Data categories | Location / transfer

Stripe, Inc. | Payments and Expert payouts (Stripe Connect) | Identity, transaction, payout data | US / SCCs + DPF

We notify customers of new sub-processors before they begin processing, allowing a reasonable objection window per the DPA.