1. Introduction

Delos Data, Inc. (“Delos Data”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at www.delosdata.com (the “Site”), including when you submit inquiries through our contact forms. The Site is intended for users in the United States. We do not direct or market our products or services to individuals in the European Economic Area or the United Kingdom.

Please read this Policy carefully. By using the Site, you agree to the practices described herein.

2. Scope of this Privacy Policy

This Privacy Policy covers only our website and specified activities. It does not apply to data processed within our products, which are governed by separate agreements with our customers.

3. Information We Collect

3.1 Information You Provide Directly

When you contact us through a form on our Site—such as a product inquiry, demo request, or general contact submission—we may collect:

• Name and job title
• Business email address
• Company name
• Phone number (if provided)
• The content of your inquiry or message

3.2 Job Applicant Information

Our Site contains a link to Ashby, Inc. (“Ashby”), a third-party recruiting platform through which you may apply for open positions. Delos Data receives and processes your applicant data as the employer; Ashby acts as a service provider processing that data on our behalf.

When you submit an application through Ashby, we may receive and process the following categories of information:

• Identifiers and contact details: name, email address, phone number, and social media account handles you provide.
• Application materials: resume or CV, cover letter, and work samples or portfolio links.
• Professional background: employment history, job titles, employers, and dates of employment.
• Educational background: institutions attended, degrees, certifications, and graduation dates.
• Responses to application questions: answers you provide to role-specific screening questions.
• References: names and contact information for professional references you supply.
• Interview records: where applicable, recordings or transcripts of interviews conducted through the Ashby platform, and summaries or feedback generated from those sessions.
• Fraud detection signals: technical signals such as IP address characteristics and device information collected by Ashby to detect fraudulent applications.
• Communication history: emails or messages exchanged with our recruiting team through the Ashby platform.

Ashby may also collect information directly for its own purposes (such as platform usage and analytics data) under its own privacy policy, available at www.ashbyhq.com/resources/privacy. We encourage you to review Ashby’s policy before submitting an application.

3.3 Information Collected Automatically

When you visit the Site, we and our third-party service providers may automatically collect certain technical information, including:

• IP address and approximate geographic location (city/region level)
• Browser type and version
• Operating system
• Pages visited and time spent on each page
• Referring URL
• Date and time of visits

This information is collected through cookies, web beacons, and similar tracking technologies. See Section 6 for more detail.

3.4 Information We Do Not Collect

We do not knowingly collect:

• Sensitive personal information such as government ID numbers, financial account data, health or medical information, or precise geolocation, except in limited circumstances in connection with our recruiting process described below in Section 10.
• Personal information from children under 13 years of age. Consistent with the CCPA, we also do not knowingly sell or share the personal information of consumers under 16. If we learn we have collected information from a child below the applicable age, we will delete it.
• Any data from within our on-premises software products.

4. How We Use Your Information

We use the information collected through the Site solely for the following purposes:

• To respond to your inquiries, demo requests, or support questions.
• To communicate with you about our products and services, if you have requested information or otherwise expressed interest.
• To evaluate job applications and communicate with candidates throughout the hiring process.
• To improve and maintain the Site and understand how visitors interact with it.
• To detect, prevent, and address security incidents or technical issues.
• To comply with applicable legal obligations, including employment and equal opportunity laws.

We do not sell your personal information.

Where we use Ashby's AI-assisted features in our recruiting process, those tools may analyze application materials or generate summaries of interview feedback to support our hiring team's review. These AI outputs are advisory only. A human reviewer always considers the full application context and makes all hiring decisions. We do not use AI to make final determinations on any candidate, and no applicant is accepted or rejected solely on the basis of an automated output. See Section 11 for jurisdiction-specific disclosures regarding our use of AI in hiring.

5. Disclosure of Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

• Service Providers: We may engage reputable third-party vendors (e.g., website hosting, CRM, email delivery, hiring) who process information on our behalf, subject to confidentiality and data protection obligations.
• Legal Requirements: We may disclose information where required by applicable law, regulation, legal process, or governmental request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred, provided the receiving party agrees to honor this Policy.
• Protection of Rights: We may disclose information to protect the rights, property, or safety of our company, employees, or the public.

Any third parties with whom we share data are contractually bound to handle it in a manner consistent with this Policy.

6. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to enhance functionality and analyze usage. Types of cookies we may use include:

• Essential Cookies: Necessary for the Site to operate correctly.
• Analytics Cookies: Help us understand how visitors use the Site (e.g., pages viewed, time on site). These are first-party cookies set directly by us; no third-party analytics platform receives or processes this data.
• Preference Cookies: Remember your settings and preferences across sessions.

You may manage or disable cookies through your browser settings. Disabling cookies may affect certain functionality of the Site. We do not currently respond to Do Not Track (DNT) browser signals, but we do not engage in cross-site behavioral advertising.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Policy, or as required by law. This table describes the retention periods and criteria for each category of personal information we collect.

If a legal claim is filed or reasonably anticipated involving any of the above categories, we will retain relevant records until final resolution regardless of the standard period. You may request deletion of your personal information at any time; we will honor such requests to the extent consistent with our legal obligations (see Section 12).

8. Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, or destruction. However, no transmission of data over the Internet can be guaranteed to be 100% secure. We encourage you to use caution when sharing information online.

9. Third-Party Websites and Ashby

Our Site contains links to third-party websites and services, including a recruiting platform through which job applicants may submit applications. When you click these links, you leave our Site and are subject to the privacy practices of those third parties.

We are not responsible for the content, security, or privacy practices of any third-party site, including Ashby. We encourage you to review their privacy policies before providing any personal information. The fact that we link to a third-party site does not constitute our endorsement of that site or its privacy practices.

10. Additional Information for Job Applicants

10.1 How We Handle Applicant Data

When you apply for a position through Ashby, the platform collects and processes your application data in accordance with its own privacy policy. We receive applicant information from the platform for the purpose of evaluating candidates and managing our hiring process.

We use applicant personal information solely to:

• Assess qualifications and suitability for open roles.
• Communicate with you about your application status.
• Conduct background or reference checks, where applicable and with your consent.
• Meet legal obligations related to employment and equal opportunity.

10.2 Retention of Applicant Data

If your application is unsuccessful, we may retain your information for up to three (3) years from the date of our final hiring decision, consistent with applicable employment law recordkeeping requirements. If you are hired, your information will be transferred to your employment file and governed by our internal HR policies.

10.3 Sharing of Applicant Data

We do not sell applicant personal information. We may share it only with:

• Internal hiring managers and interviewers involved in the relevant recruitment process.
• Background check or reference verification providers, where applicable and disclosed to you.
• Legal or regulatory authorities, if required by law.

10.4 Equal Opportunity

We are an equal opportunity employer. In connection with our hiring process, we may collect limited categories of sensitive personal information, including: (i) disability or medical condition information, where you voluntarily disclose this to request a reasonable accommodation during the application or interview process; (ii) voluntary EEO self-identification data — such as race, ethnicity, gender, veteran status, or disability status — where you choose to provide this through Ashby's optional self-identification forms; and (iii) information that may be derivable from social media profiles or handles you provide, which may incidentally reveal protected characteristics such as race, religion, or national origin. All such information is collected and used solely for the following limited purposes: to provide requested accommodations; to comply with equal employment opportunity recordkeeping obligations; and to analyze and improve diversity in our hiring funnel in aggregate and anonymized form only. We do not use sensitive personal information to draw inferences about your characteristics, predispositions, or suitability for employment beyond these stated purposes, and we handle it with strict confidentiality consistent with applicable employment law. We do not sell or share sensitive personal information.

10.5 Use of AI-Assisted Tools in Hiring

We use Ashby’s optional AI features to assist our recruiting team. The following describes how those tools operate and the safeguards in place:

• Resume screening: Ashby's AI evaluates submitted resumes against criteria we define for a role. The AI returns a signal as to whether each criterion is met or not met — it does not rank candidates or assign numerical scores. All resume review outputs are reviewed by a human hiring team member before any decision is made.
• Interview summarization: Where Ashby's AI notetaker is used, it may generate a transcript and summary of interview sessions to assist interviewers in capturing feedback. These summaries are used as a reference aid; interviewers are expected to exercise independent judgment in their evaluations.
• Bias safeguards: Before resumes are processed by AI models, Ashby redacts personally identifiable information to reduce the risk of bias from model training data. Ashby has engaged FairNow, an independent third party, to conduct a bias audit of its Criteria Evaluation model. We rely on these vendor safeguards as a baseline and review hiring outcomes for patterns of disparate impact.
• Human oversight: Consistent with our policy and the design of Ashby's platform, no hiring decision — including rejection, advancement, or offer — is made solely on the basis of an AI-generated output. A qualified human reviewer is always involved.

Where applicable law requires advance notice, bias audit disclosure, or other disclosures in connection with AI-assisted hiring, we will provide those disclosures directly to affected candidates at the time of application. Candidates who wish to inquire about the AI tools used in their application process may contact us at privacy@delosdata.com.

11. Your Privacy Rights

11.1.1 California Residents (CCPA/CPRA)

This subsection applies to California residents. Although we do not currently meet the statutory revenue or data-volume thresholds that would require compliance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), as a “business” under the statute, we provide these disclosures as a matter of policy and intend to comply with applicable requirements as our operations grow. This subsection covers personal information collected through our Site and, to the extent applicable, information received from Ashby regarding California-resident applicants.

11.1.2 Categories of Personal Information Collected

In the preceding 12 months, through our Site and recruiting processes we have collected the following categories of personal information (as defined by the CCPA):

• Identifiers: Name, email address, IP address, company name, job title, phone number.
• Professional or Employment Information: Employment history, education, skills, and references collected in connection with job applications.
• Internet or Network Activity: Browsing history on our Site, pages visited, referring URLs.
• Inferences: Derived interest in our products based on inquiry content; derived suitability for roles based on application materials.
• Sensitive Personal Information (limited recruiting context): Disability or medical condition information disclosed for accommodation purposes; voluntary EEO self-identification data (race, ethnicity, gender, veteran or disability status); and information that may be derivable from social media profiles or handles provided during the application process, which may incidentally reveal protected characteristics. Sensitive personal information is collected solely for the purposes described in Section 10.4 and is not used for profiling or inferences about individual characteristics.

Outside the limited recruiting context described in Section 10, we do not collect: Social Security numbers, financial account data, health information, biometric data, precise geolocation, or information from persons we know to be under 16. Sensitive personal information collected in the recruiting context is used solely for the purposes described in Section 10.4 and is not used for profiling or inferences about individual characteristics.

11.1.3 Sources of Personal Information

We collect personal information directly from you (contact forms, application materials forwarded from Ashby) and automatically through cookies and analytics tools when you visit the Site.

11.1.4 Business Purposes for Collection

We collect and use personal information for the business purposes described in Section 4 above: responding to inquiries, evaluating job applicants, improving our Site, ensuring security, and complying with legal obligations.

11.1.5 Disclosure and Sale of Personal Information

We do not sell personal information, and we have not done so in the preceding 12 months. We do not share personal information for cross-context behavioral advertising. We may disclose personal information to service providers for limited business purposes as described in Section 5.

11.1.6 Your California Privacy Rights

California residents have the following rights under the CCPA, subject to certain exceptions:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purposes for collection, and the categories of third parties with whom we have shared it.
• Right to Delete: You may request that we delete personal information we have collected about you, subject to certain legal exceptions.
• Right to Correct: You may request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out mechanism is required, but you may contact us to confirm. Although we do not sell or share personal information as those terms are defined under the CCPA/CPRA, we recognize and honor the Global Privacy Control (GPC) browser signal where technically feasible.
• Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information in connection with our recruiting process (as described in Sections 3.4 and 10.4), we limit its use to the specific purposes for which it was collected (e.g., accommodation, equal opportunity compliance, and aggregate diversity analysis). We do not use sensitive personal information for any purpose that would require us to offer a right to limit under CPRA § 1798.121 (such as inferring characteristics about you or advertising). California residents may contact us to inquire about or limit our use of their sensitive personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your rights under the CCPA.

11.1.7 How to Submit a Request

To exercise your rights, please contact us at privacy@delosdata.com. We will respond to verifiable requests within 45 days, with a possible 45-day extension where reasonably necessary. You may designate an authorized agent to submit a request on your behalf; we may require written authorization and verification of the agent’s identity.

We will take steps to verify your identity before processing a request. Verification may require you to provide information we already have on file so we can match it to your request.

11.2 Residents of Other U.S. States

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, and other states with applicable privacy laws may have the following rights with respect to their personal information, to the extent provided by applicable law:

• Right to Know: You may request confirmation of whether we process your personal information and access to the specific pieces of personal information we hold about you.
• Right to Delete: You may request deletion of personal information we have collected about you, subject to certain legal exceptions.
• Right to Correct: You may request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing: We do not sell personal information or share it for cross-context behavioral advertising. No opt-out action is required, but you may contact us to confirm.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To submit a request to exercise any of these rights, contact us at privacy@delosdata.com. We will respond within 45 days of receiving a verifiable request, with a possible 45-day extension where reasonably necessary. If we deny your request in whole or in part, you may appeal our decision by contacting us at the same address with the subject line “Privacy Rights Appeal.” We will respond to appeals within 45 days.

Residents of other states not listed above may also have applicable privacy rights under state law. We will honor such rights to the extent required by applicable law and will update this Policy as additional state privacy frameworks become applicable to our operations.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date at the top of this document. We encourage you to review this Policy periodically. Your continued use of the Site after changes are posted constitutes indicates your acknowledgement of the updated Policy. For material changes, we will provide additional notice, such as via email (where we have your contact details) or a prominent notice on the Site, prior to the change taking effect.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Delos Data, Inc.

Email: privacy@delosdata.com

Website: www.delosdata.com