PRIVACY POLICY Last Updated: July 10, 2026 1. INTRODUCTION Falcyn ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. 2. INFORMATION WE COLLECT We collect information that you provide directly to us, including: - Account information (name, email address, password) - Profile information (job title, organization) - Transcript data and case information - Communications and correspondence - Usage data and analytics 3. HOW WE USE YOUR INFORMATION We use the information we collect to: - Provide, maintain, and improve our services - Process transactions and send related information - Send technical notices and support messages - Respond to your comments and questions - Monitor and analyze trends and usage - Detect and prevent fraudulent transactions 4. GOOGLE USER DATA AND GMAIL INTEGRATION If an organization owner chooses to connect their Google account, Falcyn requests a single, send-only permission: the Gmail "send email" scope (https://www.googleapis.com/auth/gmail.send). We use this permission solely to send the transcript-status, assignment, and compliance emails that you or your team members initiate from within Falcyn, delivered from your organization's connected Google account. Falcyn does not read, search, download, or otherwise access the contents of your mailbox. The scope we request is send-only and technically cannot read mail. We store only the OAuth tokens needed to send on your behalf, encrypted at rest, and only until you disconnect. You may disconnect Gmail at any time in Settings, which revokes Falcyn's access and deletes the stored tokens, and you may also revoke access directly at https://myaccount.google.com/permissions. Limited Use disclosure. Falcyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: (a) we use Google user data only to provide and improve the send-email feature described above; (b) we do not transfer Google user data to others except as necessary to provide this feature, for security, or to comply with law; (c) we do not use Google user data for advertising; and (d) we do not allow humans to read Google user data except with your explicit consent for a specific message, for security or legal compliance, or where the data is aggregated and anonymized for internal operations. 5. INFORMATION SHARING AND DISCLOSURE We do not sell your personal information. We may share your information: - With your consent - To comply with legal obligations - To protect our rights and property - With service providers who assist in our operations - In connection with a business transfer or merger 6. DATA SECURITY We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. 7. DATA RETENTION We retain your information for as long as your account is active or as needed to provide services. We will retain and use your information as necessary to comply with legal obligations and resolve disputes. 8. YOUR RIGHTS Depending on your location, you may have certain rights regarding your personal information, including: - Access to your personal information - Correction of inaccurate data - Deletion of your data - Objection to processing - Data portability 9. COOKIES AND TRACKING We use cookies and similar tracking technologies to track activity on our service and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. 10. THIRD-PARTY SERVICES AND SUB-PROCESSORS Our service relies on the following sub-processors: Supabase (database and authentication), Stripe (payment processing), Resend (transactional email), and Google (OAuth sign-in and, where connected, Gmail send). Our service may also contain links to third-party websites we do not control. We are not responsible for the privacy practices of third parties. 11. AI-POWERED FEATURES Certain features of Falcyn (including AI-assisted transcript analysis) may transmit excerpts of transcript content to third-party AI providers for processing. We do not permit AI providers to use your data for training their models. Transcript excerpts are processed in-session only and are not stored by the AI provider beyond the duration of the request. You may disable AI features in your account settings. 12. COURT REPORTER PERFORMANCE DATA & SHARING WITH STENOVA In the normal course of providing transcript-compliance services, Falcyn collects performance and behavioral data about court reporters. This may include, among other things, transcript delivery timeliness, lateness and days-late metrics, no-shows, missed deadlines, and other compliance-related incidents recorded through the service. Falcyn may share this court reporter performance and behavioral data with Stenova, an affiliated court-reporter accountability service. Stenova uses information contributed by Falcyn and other sources to build and maintain reporter records and performance scores that its clients may use for screening and accountability purposes. If you are a court reporter, you may have rights with respect to records held by Stenova. Consistent with Fair Credit Reporting Act (FCRA)-style principles, you may dispute the accuracy of an incident or record and may request a security freeze on your Stenova record. These rights are exercised directly through Stenova; Falcyn does not control the records, scores, or dispute outcomes maintained by Stenova. For more information about Stenova, its records, or to submit a dispute or freeze request, please contact Stenova directly. 13. INTERNATIONAL DATA TRANSFERS If you are located outside the United States, your information may be transferred to and processed in the United States. We rely on the EU-U.S. Data Privacy Framework and, where applicable, Standard Contractual Clauses as our transfer mechanisms. We do not rely on the EU-U.S. Privacy Shield framework (invalidated in 2020). 14. CHILDREN'S PRIVACY Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. 15. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. 16. CONTACT US Falcyn 1207 Delaware Ave #4777 Wilmington, DE 19806 Security or privacy concerns: [email protected] General questions: [email protected]