This Privacy Policy describes the policies and procedures of QubitOwl, Inc. ("QubitOwl," "we," "us," or "our") regarding the collection, use, and disclosure of your information when you visit or use our website located at qubitowl.com (the "Website"). It also describes your privacy rights and how applicable law protects you.

We use your personal data to operate and improve the Website and to communicate with you about our products and services. By using the Website, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Scope of This Policy

This Privacy Policy applies exclusively to information collected through the QubitOwl website (qubitowl.com) and related marketing communications

It does not govern personal data or organizational data processed through the CONTINUUM Cryptographic Asset Discovery and Inventory (CADI) platform or any other QubitOwl product or service. Data collected, processed, and stored through the CONTINUUM platform — including cryptographic asset inventories, network telemetry, scan results, and customer-generated content — is governed exclusively by the applicable Customer Agreement, Order Form, and Data Processing Agreement (DPA) between QubitOwl and the relevant enterprise customer.

If you are a CONTINUUM customer or prospective customer inquiring about platform data handling, please refer to your Customer Agreement or contact us at privacy@qubitowl.com to request a copy of our standard Data Processing Agreement.

2. Interpretation and Definitions

Interpretation

Words with an initial capital letter have specific meanings as defined below. These definitions apply whether the terms appear in the singular or plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access our Service or parts of our Service.

• Affiliate means an entity that controls, is controlled by, or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for the election of directors or other managing authority. QubitOwl's affiliates include Ostrich Cyber-Risk, Inc.

• Company (referred to as "the Company," "we," "us," or "our") refers to QubitOwl, Inc., 2825 E Cottonwood Parkway, Ste 310 Cottonwood Heights, UT 84121.

  For the purposes of the GDPR, the Company is the Data Controller.

• Consumer, for purposes of the CCPA, means a natural person who is a California resident.

• Cookies are small files placed on your device by a website, containing details of your browsing history or session preferences.

• Country refers to: Utah, United States.

• Data Controller, for purposes of GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.

• Data Processing Agreement (DPA) means the written agreement governing QubitOwl's processing of personal data on behalf of enterprise customers in connection with the CONTINUUM platform.

• Device means any device that can access the Website, including a computer, mobile phone, or digital tablet.

• Do Not Track (DNT) is a concept promoted by U.S. regulatory authorities, particularly the FTC, for the Internet industry to develop mechanisms for allowing users to control the tracking of their online activities.

• GDPR means the General Data Protection Regulation (EU) 2016/679.

• Personal Data is any information that relates to an identified or identifiable individual. For purposes of GDPR, Personal Data means any information relating to you such as a name, identification number, location data, or online identifier. For purposes of the CCPA, Personal Data means any information that identifies, relates to, describes, or could reasonably be linked with you.

• Service refers to the Website.

• Service Provider means any natural or legal person who processes data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Website, provide the Website on behalf of the Company, perform services related to the Website, or assist the Company in analyzing how the Website is used. For purposes of GDPR, Service Providers are Data Processors.

• UK GDPR means the United Kingdom General Data Protection Regulation, as defined by the Data Protection Act 2018.

• Usage Data refers to data collected automatically, either generated by use of the Website or from the Website infrastructure itself (for example, the duration of a page visit).

• Website refers to the QubitOwl website, accessible at qubitowl.com.

• You means the individual accessing or using the Website, or the company or other legal entity on behalf of which such individual is accessing or using the Website, as applicable. Under GDPR, You may be referred to as the Data Subject or User.

3. We Do Not Sell Your Personal Information

QubitOwl does not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration.

This commitment applies to all personal data collected through the Website, including contact information submitted through demo request or contact forms, usage and analytics data, and any other personal information described in this Privacy Policy.

We do not engage in cross-context behavioral advertising that constitutes a "sale" or "sharing" under applicable U.S. privacy laws. If you are a California resident, your additional rights under the CCPA are described in Section 14.

4. Personal Data We Collect

4.1 Information You Provide to Us

When using or interacting with the Website, we may ask you to provide personally identifiable information. This may include, but is not limited to:

• First name and last name

• Email address

• Phone number

• Job title and professional role

• Company name and industry

• Address, state, province, ZIP/postal code, city

• Questions or messages you submit through contact or inquiry forms

This information is typically provided when you request a product demo, contact us with an inquiry, subscribe to marketing communications, register for an event or webinar, or otherwise interact with the Website.

4.2 Usage Data

Usage Data is collected automatically when you use the Website. It may include:

• Your device's Internet Protocol (IP) address

• Browser type and version

• The pages of the Website you visit

• The time and date of your visit and time spent on each page

• Unique device identifiers and diagnostic data

• Referring URL and traffic source information

When you access the Website from a mobile device, we may collect additional information including mobile device type, mobile device unique ID, mobile operating system, and mobile browser type.

4.3 Tracking Technologies and Cookies

We use cookies and similar tracking technologies to track activity on the Website and store certain information. The technologies we use may include:

• Browser Cookies. A cookie is a small file placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you do not accept cookies, some parts of the Website may not function properly.

• Web Beacons. Certain pages of the Website and our email communications may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, or single-pixel gifs) that permit us to count users who have visited those pages or opened an email and to gather related website statistics.

Cookies can be Persistent (remain on your device when you go offline) or Session (deleted when you close your browser). We use the following categories of cookies:

• Necessary / Essential CookiesType: Session Cookies | Administered by: Us Purpose: Required to provide services available through the Website and to enable core features. These authenticate users and prevent fraudulent use. Without these cookies, certain services cannot be provided.

• Cookie Policy / Notice Acceptance CookiesType: Persistent Cookies | Administered by: Us Purpose: Identify whether users have accepted the use of cookies on the Website.

• Functionality CookiesType: Persistent Cookies | Administered by: Us Purpose: Allow us to remember choices you make when using the Website, such as language preferences or previously entered form data.

• Tracking and Performance CookiesType: Persistent Cookies | Administered by: Third Parties Purpose: Used to track information about traffic to the Website and how users interact with it. Information gathered via these cookies may indirectly identify you as an individual visitor and may be linked to a pseudonymous identifier. We may also use these cookies to test new pages or features.

5. How We Use Your Personal Data

The Company may use your personal data for the following purposes:

• To operate and maintain the Website, including monitoring usage and ensuring security and reliability.

• To manage your Account, including managing your registration as a user of the Website or any related service portal.

• To fulfill a contract or pre-contractual obligations, including development and performance of any purchase, trial, or service agreement you have entered into with us.

• To contact you by email, telephone, SMS, or other equivalent forms of electronic communication regarding updates, security notices, or informative communications related to the functionalities, products, or services you have requested or are considering.

• To provide marketing communications — with your consent or where otherwise permitted by law — about news, special offers, events, and information about products and services similar to those you have already requested or purchased. You may opt out at any time as described in Section 5.

• To manage your requests, including attending to and processing inquiries, support requests, or demo requests you submit to us.

• For business transfers, to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.

• For analytics and improvement, including data analysis, identifying usage trends, determining the effectiveness of promotional campaigns, and evaluating and improving the Website, our products, and your experience.
  Opting out of marketing communications: You may opt out of receiving marketing or promotional emails from us at any time by clicking the unsubscribe link in any email we send or by contacting us at privacy@qubitowl.com. Opting out of marketing communications does not affect your receipt of transactional or service-related communications.

6. How We Share Your Personal Data

We may share your personal information in the following situations:

• With Service Providers. We may share your personal information with Service Providers to monitor and analyze the use of the Website, to host and operate our Website, to send emails on our behalf, or to otherwise support our business operations. Service Providers are contractually required to handle your data in accordance with this Privacy Policy.

• With Affiliates. We may share your information with our affiliates, including Ostrich Cyber-Risk, Inc., in which case we will require those affiliates to honor this Privacy Policy. Any sharing between QubitOwl and Ostrich Cyber-Risk is limited to the purposes described in this Privacy Policy and will not include platform or product data.

• For Business Transfers. We may share or transfer your personal information in connection with any merger, sale of Company assets, financing, or acquisition of all or a portion of our business to another company. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

• With Business Partners. We may share your information with business partners to offer you certain products, services, or promotions related to QubitOwl's offerings.

• For Legal Compliance. Under certain circumstances, we may be required to disclose your personal data if required by law or in response to valid requests by public authorities (such as a court or government agency), to protect and defend our rights or property, to prevent or investigate possible wrongdoing, to protect the personal safety of users or the public, or to protect against legal liability.

• With Your Consent. We may disclose your personal information for any other purpose with your explicit consent.

7. Cookies and Tracking Technologies

For more detail on the cookies we use, see Section 4.3 above. You have the following choices regarding cookies:

• Browser controls: Most web browsers allow you to refuse or delete cookies. Please refer to your browser's help documentation for instructions. Note that disabling cookies may affect your ability to use certain features of the Website.

• Analytics opt-out: You can opt out of Google Analytics data collection by installing the Google Analytics opt-out browser add-on.

• LinkedIn: If we use the LinkedIn Insight Tag on our Website for conversion tracking, you may opt out of LinkedIn's targeted advertising at linkedin.com/psettings/guest-controls.

• Industry opt-out tools:

  • NAI opt-out: networkadvertising.org/choices

  • EDAA opt-out: youronlinechoices.com

  • Data opt-out: optout.aboutads.info

Note that opt-outs are specific to the browser you use. If you change browsers or delete cookies, you will need to opt out again.

8. Analytics and Marketing Tools

The Service Providers we use may have access to your personal data. These third-party vendors collect, store, use, process, and transfer information about your activity on our Website in accordance with their own privacy policies.

Analytics

Google Analytics Google Analytics is a web analytics service offered by Google LLC that tracks and reports website traffic. Google uses the data collected to track and monitor use of the Website. This data may be shared with other Google services. You can opt out of having your activity on the Website shared with Google Analytics by installing the Google Analytics opt-out browser add-on. For more information, visit policies.google.com/privacy.

Email and Marketing Communications

We may use your personal data to contact you with newsletters, marketing, or promotional materials and other information relevant to our products and services. You may opt out of receiving any or all of these communications by following the unsubscribe instructions in any email we send or by contacting us at privacy@qubitowl.com.

We use the following email and marketing service providers:

• Hootsuite Social Media Management

• MailChimp Marketing Automation + Reporting & Analytics

9. Retention of Your Personal Data

We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy.

Account and contact data submitted through the Website (such as demo request form submissions) is retained for the duration of our business relationship with you and for a reasonable period thereafter to manage follow-up communications, resolve disputes, and comply with legal obligations.

Platform and product data is not governed by this Privacy Policy. Retention of CONTINUUM platform data is specified in the applicable Customer Agreement.

Usage Data is generally retained for a shorter period of time, except where it is used to improve the security or functionality of the Website or where we are legally required to retain it longer.

Post-termination deletion: For any registered accounts associated with the Website (such as a customer or partner portal), we will delete personal data associated with those accounts within 30 days of account termination or closure, except as otherwise required by applicable law, regulatory obligation, or as necessary to resolve disputes and enforce our agreements.

We will retain and use your personal data to the extent necessary to comply with legal obligations, resolve disputes, and enforce our legal agreements and policies.

10. International Data Transfers

Your information, including personal data, may be processed at the Company's operating offices in the United States and in any other locations where parties involved in the processing are located. This means your data may be transferred to — and maintained on — computers located outside your state, province, country, or governmental jurisdiction, where data protection laws may differ from those in your jurisdiction.

Safeguards for international transfers:

For transfers of personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to the United States or other third countries, QubitOwl relies on appropriate transfer mechanisms as required under applicable data protection law, including:

• Standard Contractual Clauses (SCCs): Where required, we use SCCs approved by the European Commission as a lawful transfer mechanism for personal data leaving the EEA.

• UK International Data Transfer Agreements: For transfers from the United Kingdom, we use UK-approved transfer mechanisms, including the International Data Transfer Agreement (IDTA) or UK Addendum to SCCs.

By using the Website and submitting your information, you consent to the transfer of your personal data as described in this Privacy Policy. We take all steps reasonably necessary to ensure that your data is treated securely and that no transfer will take place unless adequate controls are in place.

You can request additional details about the specific transfer mechanism applied to your personal data by contacting us at privacy@qubitowl.com.

11. Security of Your Personal Data

QubitOwl takes the security of your personal data seriously. As a cybersecurity company, we apply rigorous technical and organizational measures to protect your personal information, including:

• Encryption in transit: All data transmitted between your browser and our Website is encrypted using TLS 1.2 or higher.

• Encryption at rest: Personal data stored on our systems is protected using industry-standard encryption.

• Access controls: Access to personal data is restricted on a least-privilege basis, limited to personnel who require it to perform their job functions.

• Security assessments: We conduct regular security reviews of our Website and infrastructure.

• Breach notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and applicable regulatory authorities as required by applicable law.

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially appropriate means to protect your personal data, we cannot guarantee its absolute security.

12. Automated Decision-Making

QubitOwl does not make decisions about you that produce legal or similarly significant effects based solely on automated processing, including profiling, in connection with the Website.

If you are within the European Union, you have the right under Article 22 of the GDPR not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. If you believe you have been subject to such a decision, you may contact us at privacy@qubitowl.com to request human review and to express your point of view.

Note that the CONTINUUM platform performs automated cryptographic asset risk scoring and policy assessment as a core product function. This automated analysis is applied to organizational cryptographic infrastructure data — not to personal data of individual users — and is governed by the applicable Customer Agreement, not this Privacy Policy.

13. GDPR Privacy

Legal Basis for Processing Personal Data under GDPR

If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:

• Consent: You have given your consent for processing personal data for one or more specific purposes.

• Performance of a contract: Processing is necessary for the performance of an agreement with you or for pre-contractual steps at your request.

• Legal obligations: Processing is necessary to comply with a legal obligation to which the Company is subject.

• Vital interests: Processing is necessary to protect your vital interests or those of another natural person.

• Public interests: Processing is related to a task carried out in the public interest or in the exercise of official authority vested in the Company.

• Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by the Company, such as operating and improving the Website, communicating with prospects and customers, and ensuring the security of our information systems — provided those interests are not overridden by your rights and interests.

We will gladly help clarify the specific legal basis that applies to any particular processing activity. Contact us at privacy@qubitowl.com to request this information.

Your Rights under the GDPR

If you are located in the EEA or UK, you have the following rights with respect to your personal data:

Right of Access. You have the right to access, update, or request deletion of your personal data. You may request a copy of the personal data we hold about you.

• Right to Rectification. You have the right to have incomplete or inaccurate personal data we hold about you corrected.

• Right to Erasure. You have the right to request that we delete your personal data when there is no good reason for us to continue processing it, subject to certain exceptions.

• Right to Object. You have the right to object to our processing of your personal data where we are relying on legitimate interests as the legal basis, or where we are processing your personal data for direct marketing purposes.

• Right to Restriction. You have the right to request that we restrict the processing of your personal data in certain circumstances.

• Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible. This right applies to data provided by you based on consent or contract performance.

• Right to Withdraw Consent. Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

• Right Not to Be Subject to Automated Decisions. As described in Section 12, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Exercising Your GDPR Rights

To exercise any of these rights, please contact us at privacy@qubitowl.com. We may ask you to verify your identity before responding. We will endeavor to respond within 30 days of receiving your request. If we need additional time, we will notify you of the extension and the reason for it.

You also have the right to lodge a complaint with a Data Protection Authority about our collection and use of your personal data. If you are in the EEA, please contact your local data protection authority. In the UK, the relevant authority is the Information Commissioner's Office (ICO) at ico.org.uk.

14. CCPA Privacy

This section supplements the information in this Privacy Policy and applies to visitors, users, and others who reside in the State of California.

Categories of Personal Information Collected

We may collect or have collected the following categories of personal information from California residents within the last twelve (12) months: