Privacy Policy

1.Scope and Application

KLØUT Ventures LLC, a Texas limited liability company ("KLØUT Ventures," "we," "us," or "our"), respects the confidentiality of the founders, funds, investors, and companies we serve. This Privacy Policy (the "Policy") explains how we collect, use, disclose, secure, and retain personal information.

This Policy applies to:

• Our website at www.kloutventures.com and any successor or subdomain (the "Site");
• Our secure client portal and any account-based environment we make available (the "Portal");
• Our consultation booking, scheduling, and intake processes;
• Our managed services, including cap table management, 409A valuation coordination, fund administration support, intellectual property administration, and investor relations support (collectively, the "Services"); and
• Our communications with prospective clients, clients, vendors, and applicants.

This Policy does not apply to information governed by a separate written agreement between you and KLØUT Ventures. Where an executed engagement letter, master services agreement, or non-disclosure agreement imposes confidentiality or data-handling obligations that are stricter than this Policy, those stricter obligations control.

Your use of the Site, the Portal, or the Services is also governed by our Terms of Service.

2.Personal Information We Collect

We collect personal information from three sources: information you provide to us, information we receive from third parties at your direction or as required by law, and information collected automatically when you interact with the Site or Portal.

2.1 Information You Provide Directly

• Identifiers and contact details: name, business email address, telephone number, mailing address, company name, and title.
• Inquiry and booking information: the content of contact forms, consultation requests, scheduling selections, calendar availability, meeting notes, and intake questionnaire responses.
• Account and Portal credentials: username, hashed password, multi-factor authentication factors, security questions, and account preferences. We do not have access to your plaintext password.
• Engagement and client information: the documents, records, and data you or your authorized representatives upload to or generate within the Portal in connection with the Services. This may include capitalization tables, stock ledgers, option grants and exercise records, securities issuance documentation, board and stockholder consents, valuation inputs and financial statements, fund formation and subscription documents, limited partner records, capital account and distribution data, intellectual property filings and prosecution records, and investor correspondence (collectively, "Client Confidential Information").
• Verification and compliance information: information required to satisfy know-your-customer, anti-money-laundering, sanctions screening, accreditation, or beneficial ownership requirements where applicable, which may include government identification numbers or documents.
• Payment information: billing contact, billing address, and payment method details. Card and bank account numbers are collected and processed directly by our payment processor; we do not store full payment card numbers on our systems.
• Recruiting information: if you apply for a role, your resume, employment and education history, references, work authorization status, and any other information you submit.
• Communications: email, messages, support requests, and, where you have consented or where permitted by applicable law, recordings or transcripts of calls and meetings.

2.2 Information From Third Parties

We obtain limited information from third parties, generally at your direction or as required for compliance:

• From equity, fund administration, and cap table platforms (including Carta and comparable systems) to which you have granted us access on your behalf;
• From your own personnel, counsel, accountants, auditors, transfer agents, or other advisors who provide us information in connection with an engagement;
• From identity verification, sanctions screening, and background check providers where a legal or contractual obligation requires such screening;
• From publicly available sources, including government registries, securities filings, patent and trademark office records, and corporate records; and
• From professional referral sources who introduce you to us.

2.3 Information Collected Automatically

• Device and connection data: IP address, browser type and version, operating system, device identifiers, language settings, and time zone.
• Usage data: pages viewed, referring and exit pages, date and time of access, session duration, and features used.
• Portal audit data: authentication events, access timestamps, document view, page-view and download events, the order in which folders and documents are opened, estimated time spent reading, search terms entered in a document room, requests that were refused, and administrative actions. This data is retained as a security and integrity control and is used to detect unauthorized access. Where a company has granted you access to its document room, we also derive from this data a summary of how that room has been used and make that summary available to that company, as described in Section 4.6.
• Cookies and similar technologies: as described in Section 8.

The summaries described in Section 4.6 are derived records, maintained separately from the underlying audit log and retained as described in Section 16.

3.How We Use Personal Information

We use personal information only for the purposes described below:

• To deliver the Services: performing cap table administration, coordinating 409A valuations, supporting fund administration, administering intellectual property matters, and preparing investor communications.
• To operate the Portal: creating and authenticating accounts, provisioning permissions, storing and transmitting your documents, and maintaining audit trails.
• To schedule and conduct consultations: booking meetings, confirming attendance, preparing for discussions, and following up.
• To communicate with you: responding to inquiries, providing service updates, and sending administrative notices about your account, this Policy, or our Terms of Service.
• To bill and collect: invoicing, processing payments, and maintaining financial records.
• To secure our systems: detecting, investigating, and preventing fraud, unauthorized access, data exfiltration, and other malicious or unlawful activity.
• To report document room activity to the company that granted access: deriving and making available to a company hosting a document room a summary of how the counterparties it has admitted have used that room, as described in Section 4.6.
• To comply with law: meeting recordkeeping, tax, securities, sanctions, anti-money-laundering, and other legal and regulatory obligations, and responding to lawful requests from authorities.
• To establish and defend legal claims: including enforcing our agreements and protecting our rights.
• To evaluate candidates: assessing applications for employment or contracting engagements.
• To improve the Site and Services: analyzing aggregate usage patterns and diagnosing technical issues.

We use de-identified and aggregated data, data that cannot reasonably be linked to you or your company, for benchmarking, service improvement, and internal reporting. We maintain such data in de-identified form, do not attempt to re-identify it, and contractually require the same of any recipient.

We will not use your personal information for a materially different, unrelated, or incompatible purpose without first providing notice and, where required by applicable law, obtaining your consent.

4.When We Disclose Personal Information

We disclose personal information only in the limited circumstances listed in this Section. This list is exhaustive.

4.1 At Your Direction

We disclose information to parties you designate: for example, your outside counsel, accountants, auditors, transfer agent, valuation firm, investors, or a platform you have instructed us to use on your behalf. You control these instructions and may withdraw them at any time.

4.2 To Contractually Bound Service Providers

We engage a deliberately small number of vendors to perform functions on our behalf: cloud hosting and storage, secure document management, identity and access management, scheduling, email delivery, payment processing, and accounting. Every such vendor:

• Is bound by a written agreement containing confidentiality and data protection terms;
• Is permitted to process personal information only on our documented instructions and only to perform the contracted service;
• Is prohibited from selling, sharing, retaining, or using the information for its own purposes, including advertising or model training; and
• Is required to delete or return the information at the end of the engagement.

These vendors are service providers, processors, or subprocessors under applicable privacy law. Disclosures to them are not sales.

4.3 To Comply With Law or Protect Rights

We disclose personal information where we reasonably believe disclosure is required by applicable law, regulation, subpoena, court order, or governmental or regulatory demand, or is necessary to investigate suspected fraud or a security incident, enforce our agreements, or protect the rights, property, or safety of KLØUT Ventures, our clients, or the public.

Where we receive a legal demand for Client Confidential Information, we will, unless legally prohibited, provide you notice promptly and with sufficient time to seek a protective order or other relief, and we will disclose only the narrowest set of information responsive to the demand.

4.4 In a Corporate Transaction

If KLØUT Ventures is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. Any acquirer or successor will be bound by commitments no less protective than those in this Policy, and we will provide notice before your information becomes subject to a materially different privacy policy.

4.5 To Professional Advisors

We disclose information to our own attorneys, auditors, insurers, and accountants, each of whom is bound by professional or contractual duties of confidentiality, where reasonably necessary to obtain professional advice or maintain our own compliance.

4.6 To the Company Whose Document Room You Access

Where a company grants you access to its document room, we make available to that company a summary of how that room has been used: the documents opened, approximately how much of each was read, when and how often, documents returned to on separate occasions, the terms searched for, and requests that were refused.

This summary is reported at the level of the organization you were identified with when access was granted. It does not include your name, email address, IP address, or device or browser information. Where the organization you were identified with has only one participant, the summary necessarily describes that individual's activity; we disclose the number of participants alongside the summary so that this is visible to the recipient.

We make the summary available only to the company that granted the access. We do not provide it to any other party granted access to the same room, and we do not provide it to anyone outside that company.

5.What We Never Do With Your Data

The following practices are prohibited by our internal policy and by the contracts we execute with our vendors:

• We do not sell personal information. We have not sold personal information in the preceding twelve (12) months and have no plans to do so. This includes any exchange of personal information for monetary or other valuable consideration.
• We do not share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under the California Consumer Privacy Act, the Texas Data Privacy and Security Act, and comparable state laws.
• We do not rent, lease, license, barter, or trade personal information to any party.
• We do not disclose personal information to data brokers, list aggregators, advertising networks, or data cooperatives.
• We do not use Client Confidential Information to train, fine-tune, or evaluate artificial intelligence or machine learning models, whether developed by us or by a third party, and we contractually prohibit our vendors from doing so.
• We do not use your personal information to profile you for automated decisions producing legal or similarly significant effects.
• We do not use Client Confidential Information for our own investment, trading, or commercial advantage. Information obtained through an engagement is used solely to serve that engagement.
• We do not disclose the identity of our clients, including in marketing, case studies, or testimonials, without prior written consent, except where disclosure is legally compelled or occurs in a corporate transaction as described in Sections 4.3 and 4.4.

6.Client Confidential Information

Capitalization records, valuation inputs, fund financials, limited partner data, and intellectual property filings are among the most sensitive information a company holds. We treat Client Confidential Information under a heightened standard:

• Segregation. Client data is logically segregated by engagement. We do not commingle one client's records with another's.
• Least privilege. Access is limited to the personnel assigned to your engagement and to a minimal number of administrators. Access is provisioned on a need-to-know basis and revoked promptly upon role change or departure.
• Auditability. Portal access and document activity are logged.
• Personnel obligations. All KLØUT Ventures personnel and contractors are bound by written confidentiality obligations that survive the end of their engagement with us.
• Ownership. As between you and KLØUT Ventures, you retain all right, title, and interest in your Client Confidential Information. We claim no ownership in it.
• Return and deletion. Upon termination of an engagement and your written request, we will return or delete Client Confidential Information in accordance with Section 16.

Where we act as a service provider or processor on your behalf with respect to personal information of your employees, stockholders, or limited partners, you are the controller or business with respect to that information, and we process it solely on your documented instructions.

7.Legal Bases for Processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

8.Cookies and Tracking Technologies

We use a deliberately restrained set of cookies and similar technologies:

We do not deploy advertising cookies, retargeting pixels, social media tracking pixels, conversion pixels, or third-party advertising SDKs on the Site or Portal. We do not participate in advertising networks and do not permit third parties to collect information about your online activities across other websites through our Site.

8.1 Your Cookie Choices

• Browser controls. Most browsers allow you to block or delete cookies. Blocking strictly necessary cookies will prevent the Portal from functioning.
• Cookie banner. Where required by applicable law, we present a consent interface allowing you to accept or reject non-essential cookies and to change your choice at any time.

8.2 Global Privacy Control and Do Not Track

We honor opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of sale, sharing, and targeted advertising for the browser transmitting the signal. Because we do not sell or share personal information or engage in targeted advertising, such signals have no material effect on our practices, but we recognize and process them.

There is no uniform industry standard for responding to browser-initiated "Do Not Track" signals. Our practices are the same whether or not such a signal is present: we do not track you across third-party websites.

9.Your Privacy Rights and Choices

Subject to applicable law and to verification, you may exercise the following rights with respect to your personal information:

• Right to know / access: confirm whether we process your personal information and obtain a copy, along with the categories collected, sources, purposes, and categories of recipients.
• Right to correct: request correction of inaccurate personal information.
• Right to delete: request deletion of personal information we hold about you.
• Right to data portability: obtain a copy in a portable, readily usable format where technically feasible.
• Right to opt out: opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects. We do not engage in any of these activities.
• Right to limit use of sensitive personal information: direct us to limit use of sensitive personal information to permitted purposes. We already limit such use to the purposes permitted by law.
• Right to non-discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a privacy right.
• Right to withdraw consent: where processing is based on consent.
• Right to appeal: appeal a decision to decline a request, as described below.

9.1 How to Submit a Request

9.2 Verification

To protect your information, we verify requests before acting. Verification generally requires you to confirm your identity from the email address on file and, for requests involving sensitive information or Portal records, to complete an additional authentication step. We will not disclose personal information in response to an unverified request. We use information submitted for verification solely for that purpose.

9.3 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We require written proof of authorization signed by you, and we may require you to verify your identity directly with us.

9.4 Response Timing

We confirm receipt of your request within ten (10) business days and describe how we will process it. We respond substantively within forty-five (45) days, or within one (1) month where the EU or UK GDPR applies. Where reasonably necessary, we may extend this period, by an additional forty-five (45) days under U.S. state law, or by up to two (2) further months under the GDPR, and will notify you of the extension and the reason for it within the original period. Requests are free of charge unless manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline the request and explain why.

9.5 Appeals

If we decline a request, our response will explain the reason and describe how to appeal. To appeal, reply to our response or write to info@kloutventures.com with the subject line "Privacy Request Appeal." We will review the appeal and inform you in writing of our decision, and the reasons for it, within forty-five (45) days, or within sixty (60) days where the applicable state statute permits, in every case within the period required by the law of your state. If the appeal is denied, we will provide a method for contacting the applicable state Attorney General or supervisory authority to submit a complaint.

9.6 Limits on Rights

We may decline all or part of a request where an exception applies: for example, where retention is required by law, where information is necessary to complete a transaction or perform a contract, where deletion would impair our ability to detect security incidents or defend legal claims, or where the request concerns information we process solely as a service provider on behalf of a client. Where we act as a service provider, we will refer your request to the relevant client or, at their direction, assist them in responding.

9.7 Marketing Communications

You may opt out of non-essential marketing communications at any time using the unsubscribe link in any such message or by contacting us. We will continue to send transactional and administrative communications relating to your account or engagement.

10.Notice to Texas Residents

This Section supplements the Policy for residents of Texas and is provided under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch. 541) (the "TDPSA").

• Categories of personal data processed: identifiers and contact data; commercial and financial data; professional and employment data; internet and device activity; audio or visual data where a recorded consultation occurs with consent; and, where an engagement requires it, sensitive data consisting of government-issued identification numbers.
• Purposes of processing: as described in Section 3.
• Categories of personal data shared with third parties: the categories above, limited to disclosures described in Section 4.
• Categories of third parties: cloud hosting and storage providers; secure document management providers; identity and access management providers; scheduling providers; email delivery providers; payment processors; accounting and professional services providers; equity and fund administration platforms you direct us to use; companies that have granted you access to their document room, with respect to the summary described in Section 4.6; and governmental or regulatory authorities where legally compelled.
• Sale of personal data: We do not sell personal data.
• Targeted advertising: We do not process personal data for targeted advertising.
• Profiling: We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.
• Sensitive data: We process sensitive data only with your consent or as otherwise permitted by law, and only where an engagement or legal obligation requires it. We do not sell sensitive data. We do not sell biometric data.
• Opt-out preference signals: We recognize the Global Privacy Control and comparable universal opt-out mechanisms, as described in Section 8.2.

Texas residents may exercise the rights described in Section 9 and may appeal a denial as described in Section 9.5. If an appeal is denied, you may submit a complaint to the Texas Attorney General at texasattorneygeneral.gov.

11.Notice to California Residents

This Section supplements the Policy for California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA").

11.1 Sources, Purposes, and Recipients

Sources of collection are described in Section 2; business and commercial purposes are described in Section 3; and categories of recipients are described in Section 4.

11.2 No Sale or Sharing

KLØUT Ventures has not sold or shared personal information, including the personal information of consumers under sixteen (16) years of age, in the preceding twelve (12) months, and does not do so. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" mechanism; a request submitted under Section 9 will nonetheless be honored and recorded.

11.3 Limiting the Use of Sensitive Personal Information

We use and disclose sensitive personal information only for the purposes permitted under CCPA regulations: performing the Services, verifying identity, preventing fraud and security incidents, ensuring quality and safety, and complying with law. We do not use or disclose sensitive personal information to infer characteristics about you. Accordingly, we are not required to offer a "Limit the Use of My Sensitive Personal Information" link, and no such link is provided.

11.4 Retention

Retention periods are described in Section 16.

11.5 Shine the Light

California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We make no such disclosures.

11.6 Exercising Your Rights

Submit requests as described in Section 9.1. We will not discriminate against you for exercising any CCPA right.

12.Notice to Other U.S. State Residents

Residents of states with comprehensive consumer privacy statutes, including Virginia, Colorado, Connecticut, Utah, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and Arkansas, have rights substantially similar to those described in Section 9, subject to each state's specific statute and effective date. Residents of Alabama, Louisiana, Oklahoma, and Vermont will have comparable rights as their respective statutes take effect.

In each such state:

• We do not sell personal data.
• We do not process personal data for targeted advertising.
• We do not engage in profiling in furtherance of decisions producing legal or similarly significant effects.
• We process sensitive data only with consent where consent is required, and only where necessary.
• We recognize universal opt-out mechanisms in states where they are required.
• We provide an appeal process as described in Section 9.5, and will identify the applicable Attorney General or regulator if an appeal is denied.

Nevada residents: Nevada law permits residents to opt out of the sale of certain covered information. We do not sell covered information as defined under Nevada law. You may nonetheless submit a verified request to info@kloutventures.com.

Washington and Nevada health data: We do not collect consumer health data as defined under the Washington My Health My Data Act or Nevada SB 370.

13.Notice to Individuals in the EEA, UK, and Switzerland

Where the EU GDPR, UK GDPR, or Swiss FADP applies to our processing, KLØUT Ventures LLC is the controller with respect to personal information we collect for our own purposes, and a processor with respect to Client Confidential Information we process on behalf of a client.

In addition to the rights described in Section 9, you have the right to:

• Restrict processing in certain circumstances;
• Object to processing based on our legitimate interests, including at any time to direct marketing;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not make such decisions); and
• Lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office at ico.org.uk. We ask that you contact us first so we can address your concern.

Response timing. Requests from individuals protected by the GDPR are answered without undue delay and in any event within one (1) month, extendable by up to two further months where the request is complex or numerous, with notice of any extension within the first month.

EU/UK representative. KLØUT Ventures is established in the United States and directs its services to founders, companies, and funds in the United States. We do not offer goods or services to, or monitor the behaviour of, individuals in the EEA or the United Kingdom on a scale that requires the appointment of a representative under Article 27 of the EU or UK GDPR: any such processing is occasional, does not involve large-scale processing of special category data, and is unlikely to result in a risk to the rights and freedoms of individuals. We keep this assessment under review and will appoint and identify a representative here if it changes.

Providing personal information is generally necessary to enter into or perform a contract with us. If you decline to provide information we reasonably require, we may be unable to deliver the Services.

14.International Data Transfers

KLØUT Ventures is based in the United States, and our systems and those of our service providers are hosted in the United States. If you access the Site or Portal or provide information from outside the United States, your personal information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

Where we transfer personal information from the EEA, the UK, or Switzerland to the United States or another third country, we implement an appropriate transfer mechanism, which may include the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical and organizational measures such as encryption in transit and at rest and a policy of challenging overbroad government requests. You may request a copy of the relevant safeguards by contacting info@kloutventures.com.

15.Information Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption of data in transit using industry-standard TLS, and encryption of data at rest;
• Role-based access controls and least-privilege provisioning;
• Multi-factor authentication for Portal and administrative access;
• Logging and monitoring of authentication and document activity;
• Vendor security assessment prior to engagement and contractual security requirements;
• Confidentiality agreements and security training for personnel; and
• A documented incident response process, including assessment, containment, and notification.

If we determine that a breach of security has resulted in unauthorized acquisition of personal information, we will notify affected individuals and applicable regulators as and when required by law, without unreasonable delay.

16.Data Retention

We retain personal information only as long as necessary for the purpose for which it was collected, or as required or permitted by law. In determining retention periods we consider the nature and sensitivity of the information, the duration of the engagement, applicable statutes of limitation, and legal, tax, securities, and regulatory recordkeeping obligations.

Upon termination of an engagement, and at your written request, we will return or securely delete Client Confidential Information within a commercially reasonable period, except for (i) copies retained in routine encrypted backups, which are overwritten on our standard backup cycle, and (ii) records we are legally required to retain. Any retained copy remains subject to the confidentiality and security commitments in this Policy for as long as it is held.

17.Third-Party Platforms and Links

The Site and the Services may link to or interoperate with third-party platforms, including equity and fund administration systems such as Carta, scheduling tools, and payment processors. When you use such a platform, including when we access it on your behalf at your direction, that platform's own privacy policy and terms govern its collection and use of your information. We do not control and are not responsible for the privacy practices of any third party.

KLØUT Ventures is an independent firm. References to third-party certifications, platforms, or trademarks are for identification purposes only and do not imply endorsement, sponsorship, or affiliation.

We encourage you to review the privacy policy of any third-party service before providing information to it.

18.Children's Privacy

The Site, the Portal, and the Services are intended for a business audience and are not directed to children. We do not knowingly collect personal information from any individual under the age of eighteen (18). If we learn that we have collected personal information from a child without appropriate consent, we will delete it promptly. If you believe a child has provided us personal information, contact info@kloutventures.com.

19.Changes to This Policy

We may update this Policy to reflect changes in our practices or in applicable law. The "Last Updated" date at the top indicates when the Policy was last revised. If we make a material change, including any change that would expand our use or disclosure of personal information, we will provide prominent notice on the Site and, where we hold your contact information and where required by law, notify you directly before the change takes effect. Your continued use of the Site, Portal, or Services after the effective date constitutes acceptance of the revised Policy.

We maintain prior versions of this Policy and will provide a copy on request.

20.Contact Us

For questions about this Policy, to exercise a privacy right, or to submit a complaint:

We take privacy complaints seriously and will investigate and respond to any complaint we receive. If you are not satisfied with our response, you may contact your state Attorney General or, if you are located in the EEA or UK, your local supervisory authority.