Privacy Policy

HEMA AI INC.

Privacy Policy

Last Updated: June 13, 2026

Effective Date: June 13, 2026

This Privacy Policy ("Privacy Policy") describes the types of personal information that Hema AI Inc. ("Hema AI," "Company," "we," "our," or "us") collects, uses, and discloses from individuals ("you" or "your") who visit our website at www.tryhema.com and use our software, platform, and related services that link to this Privacy Policy (collectively, our "Services"). As used in this Privacy Policy, "personal information" means any information relating to an identified or identifiable individual.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, disclosure, and other processing of your personal information as described herein. If you do not agree with this Privacy Policy, please do not use our Services. Your use of our Services is also subject to our Terms and Conditions.

Processor Role. This Privacy Policy does not apply to the extent we process personal information in the role of a data processor or service provider on behalf of our business customers, including where we provide our software-as-a-service platform to such customers. In those circumstances, our customers are the data controllers, and our processing of personal information is governed by the applicable customer contracts and data processing agreements we have entered into with those customers.

Table of Contents

1. Personal Information We Collect

2. How We Use the Personal Information We Collect

3. Legal Bases for Processing Personal Information (EEA and UK)

4. How We Disclose the Personal Information We Collect

5. Cookies and Similar Tracking Technologies

6. Your Choices and Privacy Rights

7. Third-Party Websites and Services

8. Retention of Personal Information

9. Security

10. Children's Privacy

11. International Visitors and Cross-Border Transfers

12. Changes to This Privacy Policy

13. Contact Information

1. Personal Information We Collect

We may collect a variety of personal information from or about you or your devices from various sources, as described below. Where applicable, we indicate whether and why you must provide us with your personal information, as well as the consequences of failing to do so. If you do not provide personal information when requested, you may not be able to use our Services if that information is necessary to provide you with our Services, or if we are legally required to collect it.

A. Personal Information You Provide to Us

Contact and Inquiry Information. We may collect your personal information when you inquire about our Services, request a demo, or sign up for, attend, or otherwise participate in our events, webinars, or programs. This information may include your full name, work email address, phone number, company name, company size, job title, whether you are an agency, and any other information you choose to provide to us.

Account Information. We collect the information you provide when you create, update, or manage your account on the Services, including your email address, password (stored in hashed form), phone number, name, and organization details. You may also elect to provide a profile photograph for your individual account or your organization's workspace.

Communications. If you contact us directly — whether by email, telephone, our website contact form, or otherwise — we may receive information such as your name, email address, phone number, the content and attachments of any messages you send, and any other information you choose to provide. When you sign up for news, updates, or our newsletter, we will collect your email address. When you communicate with us online, third-party vendors may receive and store those communications on our behalf.

Email Engagement Data. When we send you emails, we may use embedded pixels or similar tracking technologies to collect information about your interaction with those emails, such as whether and when you open them, whether you click any links included in the emails, how long you read them, whether you forward them, and related device and location data, in order to improve our email communications and Services.

Payment Information. If you make a payment for our Services, your payment-related information — such as credit card or other financial information — is collected and processed by our third-party payment processor on our behalf. We do not store your full payment card details on our systems.

Career and Employment Applications. If you apply for a position at Hema AI, you may submit your contact information, resume, cover letter, and other application materials through our website or third-party applicant tracking systems. We will collect the information you provide, including your education, employment experience, skills, and any other details included in your application.

B. Personal Information We Collect Automatically When You Use Our Services

Location Information. When you use our Services, we may infer your approximate general location — such as city, state, or country — from your internet protocol (IP) address.

Device Information. We receive information about the device and software you use to access our Services, including your IP address, device type, unique device identifiers, web browser type and version, and operating system version.

Usage Information. We automatically receive information about your interactions with our Services, such as the pages or other content you view, the features you use, referrer information (i.e., the website or source you came from before arriving at our Services), the dates and times of your visits, log data, search queries submitted through our platform, and any actions you take within the platform.

Information from Cookies and Similar Technologies. We and our third-party partners collect information using cookies and similar tracking technologies. Please see Section 5 (Cookies and Similar Tracking Technologies) below for more detail.

C. Personal Information We Receive from Third Parties

We may receive personal information about you from third-party sources, such as data analytics providers, advertising partners, business intelligence services, and publicly available sources. We may combine this information with the information we collect directly from you and use it as described in this Privacy Policy.

2. How We Use the Personal Information We Collect

We use the personal information we collect for the following purposes:

• To provide, maintain, operate, improve, and enhance our Services;

• To personalize your experience on our Services, such as by providing tailored content, recommendations, and features;

• To understand and analyze how you and others use our Services, and to develop new products, services, features, and functionality;

• To communicate with you, provide you with updates and other information relating to our Services, respond to your inquiries and comments, and otherwise provide customer support;

• For marketing and advertising purposes, such as developing and delivering promotional and advertising materials that may be relevant or of interest to you;

• To send you administrative emails, service announcements, billing notifications, and other transactional communications relating to your account or our Services;

• To generate anonymized, aggregated, or de-identified data that does not identify you personally, which we may use for any lawful business purpose;

• To facilitate transactions, process payments, and manage billing;

• To detect, investigate, prevent, and respond to fraud, abuse, security incidents, and other harmful, unauthorized, or unlawful activity;

• For compliance purposes, including enforcing our Terms and Conditions and other legal rights, complying with applicable laws and regulations, and responding to lawful requests from judicial or governmental authorities;

• To evaluate and process job applications for open positions at Hema AI; and

• For any other purpose described to you at the time the information is collected or for which we obtain your consent.

3. Legal Bases for Processing Personal Information (EEA and UK)

If you are located in the European Economic Area ("EEA") or the United Kingdom ("UK"), we are required under the General Data Protection Regulation ("GDPR") and applicable UK data protection law to identify a valid legal basis for each purpose for which we process your personal information. Our legal bases are as follows:

• Consent. We may process your personal information where you have provided your freely given, specific, informed, and unambiguous consent to such processing. For example, we rely on your consent to send you marketing communications or to deploy non-essential cookies. You have the right to withdraw your consent at any time and free of charge; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

• Contractual Necessity. We may process your personal information where processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. For example, we need to process your account information to provide you with access to our Services.

• Compliance with a Legal Obligation. We may process your personal information where processing is necessary for compliance with a legal obligation to which we are subject, such as tax, accounting, or regulatory reporting requirements.

• Legitimate Interests. We may process your personal information where processing is necessary for the purposes of our legitimate interests or those of a third party, provided that such interests are not overridden by your interests, rights, or fundamental freedoms. Our legitimate interests include improving our Services and products, conducting internal analytics and research, ensuring the security and integrity of our Services, and communicating with you about relevant products and services.

4. How We Disclose the Personal Information We Collect

We do not sell your personal information. We may disclose your personal information in the following circumstances:

Partners and Affiliates. We may disclose personal information to our current or future corporate affiliates, subsidiaries, and parent companies for any of the purposes described in this Privacy Policy.

Vendors and Service Providers. We may disclose personal information to third-party vendors and service providers we retain in connection with the provision of our Services, including providers of cloud hosting and infrastructure, analytics, payment processing, customer relationship management, email delivery, marketing automation, security, and technical support. These parties are authorized to use your personal information only as necessary to perform services on our behalf.

Artificial Intelligence Service Providers. We may disclose information to vendors and partners that provide artificial intelligence models, infrastructure, and related services that support the core functionality of our platform.

Analytics Partners. We use analytics services, including Google Analytics, to collect and process certain analytics data about how users interact with our Services. These services may also collect information about your use of other websites, apps, and online resources. You can learn more about Google's data practices by visiting https://www.google.com/policies/privacy/partners/.

Advertising Partners. We work with third-party advertising partners to serve advertisements that may be of interest to you. These partners collect and process information about your use of our Services through cookie-based and similar technologies. Some of our advertising partners are members of the Network Advertising Initiative (https://optout.networkadvertising.org) or the Digital Advertising Alliance (https://optout.aboutads.info). Please visit those organizations' opt-out pages to learn how you may opt out of receiving interest-based advertisements from member companies. Those opt-outs apply only to partners that are members of those organizations.

As Required by Law and for Safety Purposes. We may access, preserve, and disclose your personal information if we believe doing so is required or appropriate to: (a) comply with applicable law, legal process, or lawful requests by public or governmental authorities, including law enforcement (such as a subpoena, court order, or search warrant); (b) respond to your requests; (c) protect the rights, property, or safety of Hema AI, our users, employees, or others; (d) protect against legal liability; or (e) detect, prevent, or otherwise address fraud, security, or technical issues. For the avoidance of doubt, disclosure may occur if you post objectionable or unlawful content on or through our Services.

Merger, Sale, or Other Asset Transfers. We may disclose or transfer your personal information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction, including a merger, acquisition, consolidation, reorganization, sale of assets, or similar transaction, or in the event of our bankruptcy or dissolution. We will use reasonable efforts to notify you before your personal information becomes subject to a materially different privacy policy as a result of such transaction.

With Your Consent. We may disclose your personal information for any other purpose with your prior consent.

5. Cookies and Similar Tracking Technologies

We and our third-party partners may collect information using cookies, pixel tags, web beacons, and similar tracking technologies (collectively, "Cookies") when you access or use our Services. Cookies are small files of letters and numbers stored on your browser or the hard drive of your device that contain information transferred to your device. Pixel tags and web beacons are tiny graphic images placed on web pages or in our emails that allow us to determine whether you have performed a specific action.

We use Cookies to collect information about your browsing activities and to distinguish you from other users. This improves your experience when you use our Services and allows us to improve the functionality of our Services. We use the following categories of Cookies:

A. Strictly Necessary Cookies

These Cookies are essential to make our Services available to you and enable core functionality such as security, authentication, and network management. We cannot provide our Services without these Cookies. You cannot opt out of Strictly Necessary Cookies.

B. Functional Cookies

These Cookies allow our Services to remember choices you make (such as language, region, or login preferences) and provide enhanced, personalized features. The information collected is anonymized and cannot track your browsing activity on other websites.

C. Analytical and Performance Cookies

We use these Cookies to understand how visitors interact with our Services, identify errors, measure traffic patterns, and improve our platform. We may use our own analytics Cookies or engage third-party analytics providers such as Google Analytics. These providers may also collect information about your use of other websites, apps, and online resources.

D. Advertisement Cookies

We and our advertising partners use these Cookies to build a profile of your interests and deliver relevant advertisements on our Services and on other websites and applications. They also help us measure the effectiveness of our advertising campaigns.

Please review your web browser's "Help" file to learn how you may modify your Cookie settings. If you delete or choose not to accept Cookies from our Services, you may not be able to utilize certain features to their fullest potential. You can find more information about your rights and choices, and how to block certain Cookies, in Section 6 below.

6. Your Choices and Privacy Rights

A. General Choices

Marketing Communications. You can unsubscribe from our promotional email communications at any time by clicking the "unsubscribe" link included in any such email. Even if you opt out of promotional messages, you will continue to receive administrative and transactional emails from us, such as account notices and billing communications.

Do Not Track. There is currently no accepted industry standard on how to respond to web browser "Do Not Track" signals, and we do not respond to such signals at this time.

How to Block or Manage Cookies. You can block Cookies by adjusting the settings in your internet browser. However, if you block all Cookies (including essential Cookies), you may not be able to access all or parts of our Services. You may also delete Cookies at any time or browse our Services using your browser's private or incognito mode. Please refer to your browser's instructions or help documentation to learn more about managing Cookie settings. Where required by applicable law, we will ask for your consent before installing non-essential Cookies on your device.

Opt-Out of Interest-Based Advertising. You may opt out of interest-based advertising from members of the Network Advertising Initiative by visiting https://optout.networkadvertising.org, or from members of the Digital Advertising Alliance by visiting https://optout.aboutads.info. Please note that these opt-outs are device and browser-specific and may not apply to all advertising.

If you choose not to provide us with personal information we request, some features of our Services may not function as intended.

B. Rights of EEA and UK Residents

If you are located in the European Economic Area or the United Kingdom, you have the following rights with respect to your personal information under the GDPR and applicable UK data protection law. To exercise any of these rights, please contact us using the details set out in Section 13.

• Right of Access. You have the right to request access to the personal information we hold about you, including information about the categories of personal information collected, the purposes for which it is processed, and the recipients to whom it has been disclosed.

• Right to Rectification. You have the right to request that we correct any personal information that is inaccurate or incomplete.

• Right to Erasure. You have the right to request deletion of your personal information (the "right to be forgotten") in certain circumstances, such as where the information is no longer necessary for the purposes for which it was collected.

• Right to Restriction of Processing. You have the right to request that we restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of the information.

• Right to Data Portability. You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to request that we transmit it to another controller where technically feasible.

• Right to Object. You have the right to object to our processing of your personal information where we rely on our legitimate interests as the legal basis, and where our interests are not compelling enough to override your objection.

• Right to Withdraw Consent. Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time and free of charge. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

• Right to Lodge a Complaint. You have the right to lodge a complaint with a data protection supervisory authority in your country of residence, place of work, or the place of an alleged infringement of applicable data protection law.

We will respond to verified requests within the time periods required by applicable law. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that certain rights are subject to exceptions and limitations under applicable law. While any changes you make will be reflected in our active user databases promptly or within a reasonable time, we may retain certain personal information in backups, archives, fraud prevention systems, analytics, or where we are required by law or have a legitimate reason to retain it.

7. Third-Party Websites and Services

Our Services may contain links to, or integrations with, third-party websites, products, or services that are not owned or operated by Hema AI. This Privacy Policy does not apply to your activities on such third-party services or to any information you provide to or that is collected by those third parties. We are not responsible for the privacy practices of third parties, and we encourage you to review the privacy policies of any third-party service before providing your personal information.

8. Retention of Personal Information

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. When determining the appropriate retention period for personal information, we take into account various factors, including the type and sensitivity of the information, the nature and length of our relationship with you, the possibility of re-enrollment in our Services, the potential impact on the Services if the information is deleted, and any mandatory retention obligations under applicable law and statutes of limitation.

When you request that we delete your personal information, we will take measures to delete it or render it in a form that does not permit identifying you, subject to any legal obligations that require us to retain it for a longer period. Residual copies of deleted personal information may remain in our backup systems for a limited period before being fully purged.

9. Security

We implement commercially reasonable administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. These measures include, where appropriate, encryption of data in transit (using HTTPS/TLS), encryption of data at rest, role-based access controls, regular security assessments, and employee training.

However, no method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of your information. We are not responsible for circumvention of any privacy settings or security measures contained in our Services. If you believe that your interactions with us are no longer secure, please notify us immediately at info@tryhema.com.

10. Children's Privacy

Our Services are not directed to, and we do not knowingly collect, maintain, or use personal information from, children under 18 years of age. No part of our Services is designed to attract children. If you are a parent or guardian and believe that your child under the age of 18 has provided us with personal information without your consent and in violation of this Privacy Policy, please contact us at info@tryhema.com and we will take prompt steps to delete such information.

11. International Visitors and Cross-Border Transfers

Our Services are hosted in the United States ("U.S.") and are primarily intended for users located in the U.S. If you access or use our Services from the EEA, the UK, or any other jurisdiction whose laws governing data collection and use differ from those of the U.S., please be aware that your personal information may be transferred to, stored in, and processed in the U.S. or in other countries in which we or our service providers maintain facilities.

Where we transfer personal information from the EEA or the UK to countries that have not been recognized by the European Commission or the UK Government as providing an adequate level of data protection, we rely on appropriate safeguards, including European Commission-approved Standard Contractual Clauses ("SCCs") and, where applicable, the EU-U.S. Data Privacy Framework and the UK Extension thereto. By providing your personal information on or to our Services, you acknowledge that your information may be transferred internationally as described in this Privacy Policy.

For more information about the safeguards we use for cross-border transfers of personal information, or to request a copy of relevant contractual protections, please contact us as described in Section 13.

12. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time and for any reason. We will post the revised Privacy Policy on this page and update the "Last Updated" date at the top of the policy. The revised version will be effective as of the date it is posted. If we make material changes to this Privacy Policy, we will provide more prominent notice, such as sending an email to the address associated with your account or displaying a notice on our website at www.tryhema.com. Where required by applicable law, we will seek your consent before implementing material changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and share your personal information. Your continued use of our Services after the effective date of any updated Privacy Policy constitutes your acceptance of the revised Privacy Policy.

13. Contact Information

Hema AI Inc. is responsible for, and acts as the data controller in respect of, the personal information described in this Privacy Policy. If you have any questions, comments, concerns, or requests regarding this Privacy Policy or our data processing activities, please do not hesitate to contact us:

Hema AI Inc.

131 Continental Dr, Suite 305

Newark, Delaware 19713

United States of America

Email: info@tryhema.com

Website: www.tryhema.com

Delaware File Number: 10586210

We will endeavor to respond to all inquiries within a reasonable time and, where required by applicable law, within the legally mandated response period.

* * *

This Privacy Policy was adopted by Hema AI Inc. effective June 13, 2026.