Last Updated: March 6, 2023

Graceful provides parents with a new way to preserve precious photos, videos, documents, and financialassets in a first-of-its-kind digital vault. This Privacy Policy describes how we handle the personalinformation we collect through our website, applications, and digital vault, and through our otherinteractions and correspondence with you.

Our Digital Vault

Our digital vault enables parents to store precious memories, important records, and valuable assets inone place. Parents will provide their children with a key (i.e., a token) to access the vault, and their childrencan scan their key and view the contents of the vault in augmented reality. Children cannot upload anyinformation to the vault until they reach the age at which their parents provide them with their ownaccounts. We only use the information parents provide about their children to provide our services, andwe will not use or share any information about children for marketing purposes.

Personal Information We Collect

Information you provide when you purchase the digital vault or use our services may include:

• Contact details, such as your first and last name, phone number, and email and mailing addresses.
• Vault content, including any personal information contained in the photos, videos, messages,records, and valuable assets that you may choose to upload and place in the vault. To add certaincontent, like photos or videos, you may allow us to access your phone’s camera or photo album.
• User contacts, such as your family members’ phone numbers or email addresses, that you provideto us when you send them invitations to contribute to the vault.
• Usage data, such as information about how you use the services and interact with us, includinginformation associated with any content you upload to the vault or otherwise submit to us, and information you provide when you use any interactive features of our services

• Communications that we exchange with you, including when you contact us with questions,feedback, or otherwise.

• Marketing data, such as your preferences for receiving our marketing communications, anddetails about your engagement with them.

Information about children:
We only collect information about your children with your explicit consent, to provide our services to you.

We may collect information about your children in the following ways:

• You may upload information about your children’s names and ages when you personalize the vault, and you may provide us with personal information about your children contained in the photos, videos, messages, records, and other valuable assets you place in the vault.
• We may also collect metrics about users of our app who view the contents of the vault, but we donot link any app usage data to a specific child’s identity.

We do not collect information about children from any other sources. We do not market to children, andwe do not “sell” or “share” children’s information, as such terms are defined in the California ConsumerPrivacy Act of 2018 (the “CCPA”).

Information we obtain from third parties:

• Social media information. We may maintain pages on social media platforms, such as Facebook,Twitter, and Instagram. When you visit or interact with our pages on those platforms, you or theplatforms may provide us with information.
• Other sources. We may obtain personal information from other third parties, such as marketingpartners, publicly-available sources, and data providers.

Information we collect automatically:

We, our advertising partners, and our service providers may automatically log information about you,your computer or mobile device, and your interaction over time on the services, such as:

• Device data, such as your computer’s or mobile device’s operating system type and version,manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device

type (e.g., phone, tablet), IP address, language settings, mobile device carrier, radio/networkinformation (e.g., WiFi, LTE, 3G), and general location information such as city, state, or geographicarea.

• Online activity data, such as the pages or screens you viewed, how long you spent on a page orscreen, the website you visited before browsing to our website, navigation paths between pagesor screens, information about your activity on a page or screen, access times, duration of access,and whether you have opened our marketing emails or clicked links within them.

We use the following tools for automatic data collection:

• Cookies, which are text files that websites store on a visitor‘s device to uniquely identify the

visitor’s browser or to store information or settings in the browser for the purpose of helping younavigate between pages efficiently, remembering your preferences, enabling functionality,helping us understand user activity and patterns, and facilitating interest-based advertising.

• Local storage technologies, like HTML5, that provide cookie-equivalent functionality but canstore larger amounts of data, including on your device outside of your browser in connection with

specific applications.

• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that awebpage or email was accessed or opened, or that certain content was viewed or clicked.

How We Use Personal InformationTo operate our services:

• Provide, operate, maintain, secure, and improve our services.
• Communicate with you about our services, including by sending you announcements, updates, security alerts, and support and administrative messages.

• Understand your needs and interests, and personalize your experience with our services and our

communications.
• Respond to your requests, questions, and feedback.

For research and development. As part of these activities, we may create aggregated, de-identified orother anonymous data from personal information we collect. We may use this anonymous data and shareit with third parties for our lawful business purposes, including to analyze and improve the services.

For marketing and advertising.

• Direct marketing. We may send you direct marketing communications as permitted by law viaemail and other means. You may opt out of our marketing communications as described in the Optout of marketing communications section below.
• Interest-based advertising. We may engage third-party advertising companies to display our adson their online services. We may also share information about our users with these companies tofacilitate advertising for our services to them or similar users on other online platforms. For more

information, or to understand your choices, please visit the Privacy Rights and Choices sectionbelow.

For compliance and protection, including to:

• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenasor requests from government authorities.
• Protect our, your or others’ rights, privacy, safety, or property (including by making and defendinglegal claims).
• Audit our internal processes for compliance with legal and contractual requirements and internal

policies.

• Enforce the terms and conditions that govern our services.
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegalactivity, including cyberattacks and identity theft.

How We Share Personal Information

We may share personal information with:

ACTIVE/121515371.1

Service providers. Companies and individuals that provide services on our behalf or help us operate ourservices or our business (such as data hosting, information technology, customer support, email delivery,and website analytics services).

Advertising partners. We may share personal information that we collect on our website with thirdparty advertising companies (including for the interest-based advertising purposes described above),lead generation partners, and channel partners, resellers, and distributors that allow us to explore andpursue growth opportunities.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where

necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe ingood faith to be necessary or appropriate for the compliance and protection purposes described above.

Business transferees. Acquirers and other relevant participants in business transactions (or negotiationsfor such transactions) involving a corporate divestiture, merger, consolidation, acquisition,reorganization, sale, or other disposition of all or any portion of the business or assets of, or equityinterests in, Graceful (including, in connection with a bankruptcy or similar proceedings).

Privacy Rights and Choices

Opt out of marketing communications. You may opt out of marketing-related communications byfollowing the opt-out or unsubscribe instructions contained in the marketing communications we sendyou. You may continue to receive service-related and other non-marketing communications.

Opt out of push notifications. If you opt in to receive push notifications within the app, we may send

push notifications or alerts to your mobile device from time to time. You can deactivate pushnotifications and alerts at any time by changing your device settings, changing the push notificationsettings within the app, or deleting the app.

Privacy rights. Depending where you reside, you may have the following rights:

• Information. You may have the right to obtain information about how we collect, use, and shareyour personal information. We provide this information within this Privacy Policy.
• Access, correction, and deletion. You may also have the right to request access to your personalinformation, to correct personal information that is out of date or inaccurate, or to delete personal

information that is no longer needed for a permitted purpose.

• Opt out of sharing personal information for targeted advertising. We do not “sell” or “share” (asdefined in the CCPA) any personal information we collect about children through the vault.However, we use cookies on our website to help us advertise our services on other websites youmight visit. We may share information we collect via our website, such as information about thepages you visit on our website, with our advertising partners to support our interest-based

advertising. You can opt out of our sharing of personal information for these purposes as describedin the Opt out of interest-based advertising section below.

ACTIVE/121515371.1

To exercise these privacy rights, or if you have any questions about we handle your personalinformation, please contact us as provided in the Contact Us section below. Where these rights apply,you are entitled to exercise these rights free from discrimination.

Limitations. Your rights may be limited under applicable laws, such as where fulfilling your requestwould impair the rights of others, our ability to provide a service you have requested, or our ability tocomply with our legal obligations and enforce our legal rights.

Opt out of interest-based advertising. You may limit online tracking by:

• Blocking cookies in your browser. Most browsers let you remove or reject third-party cookies,including cookies used for interest-based advertising. To do this, follow the instructions in yourbrowser settings. Many browsers accept cookies by default until you change your settings. Formore information about cookies, including how to see what cookies have been set on your deviceand how to manage and delete them, visit www.allaboutcookies.org.
• Blocking advertising ID use in your mobile settings. Your mobile device settings may providefunctionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
• Using privacy plug-ins or browsers. You can block our websites from setting cookies used forinterest-based ads by using a browser with privacy features, like Brave, or installing browserplugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third partycookies/trackers. You can also opt out of Google Analytics by downloading and installing thebrowser plug-in available at: https://tools.google.com/dlpage/gaoptout.
• Platform opt outs. Some advertising partners offer opt out features that let you opt out of use of

your information for interest-based advertising, including:

o Google: www.adsettings.google.com
o Facebook: https://www.facebook.com/about/ads

o Digital Advertising Alliance for Websites: outout.aboutads.info
o Digital Advertising Alliance for Mobile Apps: https://youradchoices.com/appchoiceso Network Advertising Initiative: optout.networkadvertising.org

Note that because these opt out mechanisms are specific to the device or browser on which they areexercised, you will need to opt out on every browser and device that you use.

• Advertising industry opt out tools. You can also use these opt out options to limit use of yourinformation for interest-based advertising by participating companies:

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the onlineservices that you visit. Our website does not currently respond to "Do Not Track" or similar signals. To find

out more about “Do Not Track,” please visit http://www.allaboutdnt.com.Other Sites and Services

ACTIVE/121515371.1

Our services may contain links to websites and other online services operated by third parties. In addition,our content may be integrated into web pages or other online services that are not associated with us.These links and integrations are not an endorsement of, or representation that we are affiliated with, anythird party. We do not control websites or online services operated by third parties, and we are notresponsible for their actions.

Data Security

We employ a number of technical, organizational, and physical safeguards designed to protect thepersonal information we collect. However, no security measures are failsafe and we cannot guarantee the

security of your personal information.

Children

We do not collect personal information directly from children under 13 years of age. Parents who use thedigital vault may authorize their children to access it, and may store personal information of their childrenin the vault. If we learn that we have collected personal information through our services from a childunder 13 without the consent of the child’s parent or guardian as required by law, we will delete it.

Data Retention

We may retain your personal information for as long as it is reasonably needed in order to maintain andexpand our relationship and provide you with our services; in order to comply with our legal andcontractual obligations; or to protect ourselves from any potential disputes.

To determine the appropriate retention period for personal information, we consider the amount,

nature, and sensitivity of such information, the potential risk of harm from unauthorized use ordisclosure of such information, the purposes for which we process it, and the applicable legalrequirements.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this PrivacyPolicy, we will notify you.

Contact Us

You can reach us by email at info@graceful.io or at the following mailing address:

Graceful Inc
4555 Valley Commons DriveBozeman, MT 59718

ACTIVE/121515371.1

‍