Privacy & AI Processing Notice

---

Effective Date: August 25, 2025

Version: v1.0

Controller: Y Capital Partners, LLC, a Delaware limited liability company

Mailing address: 1500 Chestnut St, Suite 2, PMB 1069, Philadelphia, PA 19102

Privacy contact: privacy@ycapital.pe

1. Scope

This notice explains how we collect, use, disclose, and protect personal data and confidential company information in connection with Yellowwood, including intake forms, report generation, and follow-up communications. It applies globally and should be read together with our Evaluation Terms.

2. What we collect

2.1 Personal data we collect

Identification and contact data such as name, business email, company, and role or affiliation. Technical and interaction data such as IP address, device or browser information, timestamps, form metadata, and service logs. Billing and account data limited to payment metadata from our payment processor. We do not receive or store full payment card numbers.

2.2 Company data we collect

Inputs you submit for analysis, including financial, operational, and strategic information about a company. These Inputs may include confidential or proprietary data. Avoid including unnecessary personal data in Inputs.

3. Sources

Directly from you when you submit a form, upload content, correspond with us, or purchase add-ons. Automatically through our service and vendors for security, delivery, and troubleshooting. From your organization if another user submits your work email or associates you to an account.

4. How we use data

4.1 Purposes for personal data

Provide and administer Yellowwood, deliver reports, and operate evaluation workflows. Communicate about submissions, results, follow-ups, support, and account notices. Secure, monitor, prevent abuse, and troubleshoot the service. Maintain records, audit usage, and comply with legal obligations. With consent, send optional updates about product features or programs.

4.2 Purposes for company data

Generate AI-assisted analyses and reports for your internal use. Provide the single resubmission or refresh within the defined correction window. Improve accuracy and reliability of Yellowwood in aggregate without using your Inputs to identify you or your company outside the service context.

5. Legal bases (EU and UK)

Where GDPR or UK GDPR applies, we process personal data on the following bases: contract necessity to provide the service, deliver reports, and support your account; legitimate interests to secure and improve Yellowwood, prevent abuse, and maintain records, balanced against your rights; consent where required for optional communications or certain cookies; legal obligations for recordkeeping, tax, sanctions, or court requirements.

6. Use of AI

We use AI models to help analyze Inputs and generate Outputs. We instruct our AI model providers not to use your Inputs or Outputs to train or improve generalized models. For API processing, a model provider may retain limited data in internal logs for service integrity and abuse monitoring for up to 30 days or longer if required by law. These logs are not public and are accessible only to authorized personnel. We do not make final determinations affecting you based solely on automated processing. Human review is part of our workflow.

7. Subprocessors and disclosures

We use trusted service providers to operate Yellowwood. Typical categories include AI model providers for analysis; form and data collection providers for intake; email and CRM providers for communications and support; payment processors for paid reports and subscriptions; cloud hosting, storage, logging, and workflow automation. Service providers act under written contracts, must protect data, and may process data only to deliver their services to us. We do not sell personal data. We disclose data outside this framework only if required by law or with your direction. A current list of key subprocessors is available on request at privacy@ycapital.pe.

8. International transfers and DPA

We operate globally and may transfer personal data across borders, including to the United States. Where required, we implement appropriate safeguards, including the EU Standard Contractual Clauses and the UK Addendum. If you are a customer subject to GDPR, UK GDPR, or LGPD, our Data Processing Addendum with applicable transfer mechanisms is available on request and, when signed or referenced, is incorporated by reference into our terms with you.

9. Cookies and similar technologies

We use cookies and similar technologies to make our site work and to understand how it is used. Essential cookies are always on. They are related to security, load balancing, and session management needed to operate the site. Analytics and marketing cookies are optional. They help us measure traffic or personalize content.

We set only essential cookies unless you Accept on the cookie banner. If you select Decline, we will not set non-essential cookies. You can change your choice at any time in Cookie Settings or by clearing cookies in your browser. See this notice for how we handle personal data and your rights.

10. Payments

Payments for additional reports and subscriptions are processed by our payment processor. We do not collect or store full payment card numbers. We receive transaction metadata such as amount, last four digits, and card type to reconcile payments and provide receipts.

11. Retention

Personal data such as names and emails are retained for ongoing account administration and records unless you request deletion and we have no legal basis to retain. Company Inputs and related Outputs are retained for the duration needed to provide the service, support the correction window, address requests, and maintain audit logs, then deleted or archived securely. Vendor service logs are retained per vendor policy, for example up to 30 days for certain AI integrity logs. We periodically review retention and delete or de-identify data that is no longer needed.

12. Security

We implement administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit and at rest, access controls, and least-privilege practices. We require vendors to implement comparable protections. If we become aware of unauthorized access to personal data in our possession, we will notify affected individuals and regulators as required by law.

13. Your rights and choices

Depending on your location, you may have rights to access, correct, update, or delete personal data; object to or restrict certain processing; withdraw consent where processing is based on consent; receive a copy of personal data in a portable format; and lodge a complaint with a supervisory authority. We process rights requests manually. To exercise your rights, email privacy@ycapital.pe and include “Data Rights Request” in the subject line. We may need to verify your identity before acting on a request. We will respond within applicable legal timeframes.

14. Children

Yellowwood is a business tool intended for adults. We do not knowingly collect personal data from children.

15. Regional addenda

15.1 EU and UK GDPR addendum

Controller: Y Capital Partners, LLC. Representative: where required, we will designate a representative and publish details in this notice. Legal bases: as listed in Section 5. Transfers: we rely on appropriate safeguards, including Standard Contractual Clauses and the UK Addendum. Retention: as described in Section 11. Rights: access, rectification, erasure, restriction, portability, objection, and the right to complain to your supervisory authority. Automated decision-making: we do not make decisions producing legal or similarly significant effects solely by automated means in the context of Yellowwood.

15.2 Brazil LGPD addendum

Controller: Y Capital Partners, LLC. Legal bases: contract performance, legitimate interests balanced with rights, consent where required, and legal obligations. Data subject rights: confirmation, access, correction, anonymization, portability, deletion, information about sharing and consent, and review of automated decisions. International transfers: safeguarded by contractual mechanisms and compliance commitments. DPO contact: privacy@ycapital.pe.

15.3 India DPDPA addendum

Data fiduciary: Y Capital Partners, LLC. Purposes: provision of Yellowwood, support, security, and compliance. Notice and consent: we provide notice at or before collection and obtain consent where required. You may withdraw consent by emailing privacy@ycapital.pe. Data principal rights: access, correction, erasure, and grievance redressal. Grievance contact: privacy@ycapital.pe.

16. Changes

We may update this notice from time to time. Material changes will be posted on our website and, where appropriate, notified by email. The effective date at the top reflects the latest version.

17. Contact

For questions about this notice or our data practices, contact privacy@ycapital.pe or mail us at the address listed above.

18. Governing law

This notice and any non-contractual obligations arising out of or in connection with it are governed by the laws of the State of Delaware, USA, without regard to conflict-of-laws rules. This does not limit any mandatory protections under the laws applicable to you.