Privacy Policy Last updated: 7/17/2026 This Privacy Policy describes how cactus.ai Inc ("Cactus," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you purchase, access, or use Cactus and any associated software, websites, and services (collectively, the "Services"). By using the Services, you agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree with this Policy, please do not use the Services. 1. Who We Are Cactus.ai Inc is the data controller responsible for your personal information under this Policy. If you have questions or wish to exercise your privacy rights, you can reach us using the details in the "Contact Us" section below. 2. Scope of This Policy This Policy applies to personal information we process in connection with the Services. It does not apply to third-party products, websites, or services that we do not own or control, even where they are linked from or integrated with the Services. 3. Information We Collect We collect information in the following ways: 3.1 Information You Provide to Us •Account and registration data: name, email address, username, password, and organization or company name. •Billing and payment data: billing address and transaction details. Payment card details are processed by our third-party payment processor and are not stored by us. •License and purchase data: the products or plans you purchase, license keys, and order history. •Support and communications: information you provide when you contact us for support, submit feedback, or otherwise correspond with us. 3.2 Information We Collect Automatically •Usage and device data: IP address, browser type, operating system, device identifiers, application version, feature usage, and interaction logs. •Diagnostic and performance data: crash reports, error logs, and performance metrics used to maintain and improve the Services. •Cookies and similar technologies: as described in the "Cookies and Tracking Technologies" section below. 3.3 Information From Third Parties We may receive information about you from third parties such as payment processors, resellers, analytics providers, and identity or single sign-on providers, where you have chosen to use those services in connection with ours. 4. How We Use Your Information We use your personal information to: •provide, operate, maintain, and secure the Services; •process purchases, manage licenses, and deliver the products you have paid for; •authenticate users and prevent fraud or unauthorized access; •provide customer support and respond to your inquiries; •send administrative and transactional communications, including service notices and updates; •monitor, analyze, and improve the performance, features, and usability of the Services; •send marketing communications where you have opted in or where otherwise permitted by law (you may opt out at any time); •comply with legal obligations and enforce our agreements. 5. Legal Bases for Processing If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, we process your personal information on one or more of the following legal bases: •Performance of a contract: to provide the Services you have purchased and fulfil our obligations to you. •Legitimate interests: to operate, secure, and improve our Services, provided these interests are not overridden by your rights. •Consent: where you have given consent, such as for certain marketing communications or non-essential cookies. •Legal obligation: to comply with applicable laws and regulatory requirements. 6. How We Share Your Information We do not sell your personal information. We may share it in the following limited circumstances: •Service providers: with vendors who perform services on our behalf, such as hosting, payment processing, analytics, and customer support, under contractual confidentiality and data-protection obligations. •Legal and safety: where required to comply with applicable law, legal process, or a lawful government request, or to protect the rights, property, or safety of [COMPANY SHORT NAME], our users, or others. •Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case personal information may be transferred as part of that transaction. •With your consent: where you have directed or authorized us to share your information. 7. Cookies and Tracking Technologies We and our service providers use cookies and similar technologies to operate the Services, remember your preferences, analyze usage, and improve your experience. You can control cookies through your browser settings and, where applicable, through our cookie-consent tools. Disabling certain cookies may affect the functionality of the Services. 8. Data Retention We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When personal information is no longer required, we will delete or anonymize it in accordance with our retention practices and applicable law. 9. Data Security We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. 10. International Data Transfers Your personal information may be transferred to, and processed in, countries other than the country in which you reside, including United States of America. These countries may have data-protection laws that differ from those in your jurisdiction. Where we transfer personal information internationally, we implement appropriate safeguards, such as Standard Contractual Clauses, to protect your information as required by applicable law. 11. Your Privacy Rights Depending on your location, you may have some or all of the following rights regarding your personal information: •the right to access the personal information we hold about you; •the right to request correction of inaccurate or incomplete information; •the right to request deletion of your personal information; •the right to object to or restrict certain processing; •the right to data portability; •the right to withdraw consent where processing is based on consent; •the right to opt out of marketing communications; •the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us using the details below. We will respond within the timeframes required by applicable law. We will not discriminate against you for exercising your privacy rights. For California residents: You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell personal information as defined under applicable law. 12. Children’s Privacy The Services are not directed to children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action. 13. Third-Party Links and Services The Services may contain links to or integrations with third-party websites and services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing them with any information. 14. Changes to This Policy We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where required, provide additional notice. Your continued use of the Services after the changes take effect constitutes your acceptance of the revised Policy. 15. Contact Us If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at: Cactus.ai Inc 126 College Avenue, Somerville, MA www.trycactus.ai