Drawbridge AI - Online Privacy Statement

Effective Date: June 9, 2026

This Privacy Statement explains how Drawbridge AI ("Drawbridge," "we," "our," or "us") collects, uses, and protects Personal Information when you interact with our services, platform, and website. It also outlines your rights regarding your Personal Data.

Drawbridge AI is committed to safeguarding your privacy. This Privacy Statement applies to Personal Information collected from individuals who interact with us through our websites at drawbridge.ai and usedrawbridge.com, our AI-powered process intelligence platform, or other communications, including email, phone, virtual meetings, or in-person interactions (collectively, the "Sites and Services").

This Privacy Statement is provided to inform you about our data practices in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

• You means the individual accessing or using our Services, or the company or other legal entity on behalf of which such individual is accessing or using the Services. Under GDPR, You may be referred to as the Data Subject or User.
• Company refers to Drawbridge AI ("Drawbridge," "We," "Us," or "Our") as used throughout this Privacy Statement. For purposes of GDPR, the Company acts as a Data Controller with respect to Personal Data it collects directly (e.g., website visitors, business contacts) and as a Data Processor when processing Personal Data on behalf of its clients.
• Account means a unique account created for You to access our Services or parts of our Services.
• Website refers to Drawbridge AI, accessible from drawbridge.ai and usedrawbridge.com.
• Service refers to the Drawbridge AI platform, website, and related services.
• Personal Data is any information that relates to an identified or identifiable individual. For GDPR purposes, this includes name, identification number, location data, or online identifiers. For CCPA purposes, it means information that identifies, relates to, or could reasonably be linked with You.
• Cookies are small files placed on Your device by a website, containing details of Your browsing history and preferences.
• Usage Data refers to data collected automatically, generated by the use of the Service or its infrastructure.
• Service Provider means any natural or legal person who processes data on behalf of the Company, including third-party companies or individuals employed to facilitate, provide, or analyze use of the Service.

Information We Collect

Business Contacts

We collect business contact information such as name, company, title, email address, and phone number to manage and maintain relationships with current and prospective clients, partners, and service providers. This information may be stored in third-party customer relationship management (CRM) systems. We may also track engagement with communications (e.g., email opens or link clicks) to improve our services and outreach.

Clients and Platform Users

We collect only the Personal Information necessary to fulfill contractual obligations and provide our AI-powered process intelligence services. When processing Personal Information on behalf of clients — such as operational workflows, process documentation, and stakeholder data captured through our platform — we act as a Data Processor under the client's instructions. We expect clients to inform individuals about how their data will be used.

We may also use this information for legitimate business purposes such as improving our platform, analyzing trends, and developing new capabilities to support AI transformation programs.

Website Users

When you visit our Sites, we may collect information in the following ways:

• Information you provide directly, such as through forms, demo requests, or inquiries
• Automatically collected data, including IP address, browser type, pages visited, time and date of visit, and time spent on pages
• Information from third-party sources, such as professional networks or analytics partners

We use cookies and similar technologies to enhance user experience. Cookies may have varying expiration periods, limited in duration in accordance with applicable regulations.

Suppliers and Partners

We may collect Personal Information about vendors, suppliers, and subcontractors to manage contracts and business relationships, ensure compliance, and facilitate service delivery.

Personally Identifiable Information (PII)

Personal Information we may collect includes, but is not limited to:

• Name, email address, phone number, and organization
• Communication details including emails, inquiries, and form submissions
• Social media profile information where applicable
• Publicly available data such as professional profiles or published work
• Device identifiers, IP addresses, and usage data collected through our platform

Tracking Technologies and Cookies

We use cookies and similar tracking technologies including beacons, tags, and scripts to collect and track information and to improve and analyze our Services. Cookies may be Persistent (remaining on your device when you go offline) or Session Cookies (deleted when you close your browser).

We use the following categories of cookies:

• Necessary / Essential Cookies - Required to provide core services and authenticate users.
• Functionality Cookies - Allow us to remember your preferences and login details.
• Tracking and Performance Cookies - Used to track traffic and analyze how users interact with our Services.

You can instruct your browser to refuse all cookies or indicate when a cookie is being sent. However, disabling cookies may affect the functionality of our Services.

How We Use Your Information

We process Personal Information based on lawful grounds including consent, contractual necessity, and legitimate business interests. We use Personal Information to:

• Manage client relationships and business communications
• Provide, operate, and improve our AI process intelligence platform and services
• Compress knowledge acquisition for transformation teams by turning stakeholder interviews and documents into process maps, SOPs, and runbooks
• Help clients scope and price transformation programs with accurate operational context
• Send updates, newsletters, or marketing communications (with opt-out available)
• Support administrative and operational functions
• Conduct analytics and business development
• Maintain system security and platform integrity
• Host events, surveys, and product demonstrations
• Comply with legal and regulatory obligations

We may combine and analyze data to improve our services and user experience. Aggregated or anonymized data may be used or shared for analytical purposes.

Sharing of Information

We may share Personal Information in the following circumstances:

• With Service Providers who process data on our behalf to monitor, analyze, and support our Services, subject to confidentiality obligations
• For Business Transfers: in connection with any merger, acquisition, sale of assets, or restructuring of our business, with prior notice provided
• With Business Partners to offer relevant products, services, or promotions
• To comply with legal obligations or valid requests by public authorities such as courts or government agencies
• To protect our rights, users, property, or business operations
• With professional advisors such as legal counsel, auditors, and insurers

We only share data where legally permitted and implement appropriate safeguards to protect it. We do not sell Personal Information to third parties.

A list of our current subprocessors is available upon request by contacting privacy@drawbridge.ai.

Data Retention

We retain Personal Information only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. Specifically:

• Client and contact data is retained for the duration of the business relationship and for a reasonable period thereafter for legal and business purposes
• Usage Data is generally retained for a shorter period, except where used to strengthen security, improve functionality, or where we are legally obligated to retain it longer
• Personal Information collected through our platform is retained in accordance with applicable client agreements and data processing terms

Upon expiration of the applicable retention period, Personal Information is securely deleted or anonymized.

Your Choices and Rights

Depending on your jurisdiction, you may have the following rights with respect to your Personal Information:

• Request access to the Personal Information we hold about you
• Request correction of incomplete or inaccurate data
• Request deletion of your Personal Data where there is no compelling reason for us to continue processing it
• Object to or restrict certain types of processing
• Request the transfer (portability) of your Personal Data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent
• Opt out of marketing communications at any time

To exercise any of these rights, please contact us at privacy@drawbridge.ai. We will respond to verifiable requests within the timeframes required by applicable law.

GDPR Privacy (European Users)

Legal Basis for Processing

We may process Personal Data under the following legal bases:

• Consent: You have given explicit consent for processing for one or more specific purposes
• Performance of a contract: Processing is necessary to fulfill an agreement with You
• Legal obligations: Processing is necessary to comply with applicable law
• Vital interests: Processing is necessary to protect life or safety
• Legitimate interests: Processing is necessary for our legitimate business interests, provided these are not overridden by your rights

Your Rights under GDPR

If you are located in the European Economic Area (EEA), you have the right to lodge a complaint with your local data protection authority. Please contact us at privacy@drawbridge.ai to clarify the specific legal basis for any processing activity.

CCPA Privacy (California Residents)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):

• The right to notice of the categories of Personal Data collected and the purposes for which it is used
• The right to access and request information about Personal Data disclosed in the past 12 months
• The right to request deletion of your Personal Data collected in the past 12 months
• The right to say no to the sale of your Personal Data (note: Drawbridge AI does not sell Personal Data)
• The right not to be discriminated against for exercising any of your CCPA rights

To exercise your California privacy rights, contact us at privacy@drawbridge.ai. We will respond to verifiable requests within 45 days, with the option to extend by an additional 45 days when reasonably necessary.

California's "Shine the Light" law (Civil Code Section 1798) also permits California residents with an established business relationship to request information once per year about sharing their Personal Data with third parties for direct marketing purposes.

Cookies Management

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Drawbridge AI Sites and Services. Most browsers allow you to block or limit cookies through their privacy settings. For more information on how to manage cookies in your specific browser, consult your browser's help documentation.

Security

The security of your Personal Data is important to us. We implement appropriate administrative, technical, and physical safeguards to protect Personal Information against unauthorized access, disclosure, alteration, or destruction. Access is limited to authorized personnel on a need-to-know basis.

Please be aware that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Third-Party Links and Services

Our Sites and Services may contain links to third-party websites, platforms, or services that are not operated by us. We are not responsible for the privacy practices of these third parties, and we encourage you to review their respective privacy policies.

We may use third-party analytics and advertising services to monitor and improve our Services, including tools such as Google Analytics. These providers may use cookies and similar technologies to collect usage data in accordance with their own privacy policies.

Children's Privacy

Our Services are not directed to children under the age of 13 (or under 16 in certain jurisdictions), and we do not knowingly collect Personal Information from children. If we identify that Personal Information has been collected from a child without appropriate parental consent, it will be promptly deleted. If you believe we have inadvertently collected such information, please contact us immediately at privacy@drawbridge.ai.

International Data Transfers

As a technology company serving global clients, Personal Information may be processed or stored in countries outside your country of residence, including the United States and the European Union.

When transferring Personal Data outside the EEA, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission and data processing agreements with all subprocessors. A list of our current subprocessors is available upon request by contacting privacy@drawbridge.ai.

Updates to This Privacy Statement

We may update this Privacy Statement from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any material changes will be posted on this page with an updated effective date. Where required by law, we will notify you of material changes via email or a prominent notice on our Services prior to the changes becoming effective.

We encourage you to review this Privacy Statement periodically to stay informed about how we protect your information.

Contact Information

If you have questions, concerns, or requests regarding this Privacy Statement or our data practices, please contact us:

© 2026 Drawbridge AI. All rights reserved.