Privacy Policy

1. Introduction and Scope

Kaaj Technologies, Inc. ("Kaaj," "we," "us," or "our") is committed to protecting the privacy of those who use or interact with our services. This Privacy Policy describes how we collect, use, disclose, and protect personal information obtained through: (i) our website at https://kaaj.ai and any other websites we operate that link to this policy (the "Website") and (ii) our AI-powered underwriting platform and related software applications, APIs, and tools (the "Platform") (together, the "Services").

Our Services are designed for businesses — primarily lenders, equipment finance companies, brokers, and other financial services organizations ("Customers," "you," or "your") — and their authorized users. This policy explains our practices with respect to two distinct categories of information: (a) information we collect directly about users of our Website and Platform, and (b) information submitted to the Platform by Customers in connection with their use of the Services ("Customer Data"), which may include information about their borrowers and applicants.

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy.

2. About Our Services

Kaaj provides an AI-powered underwriting operating system that helps small business lenders, equipment finance companies, brokers, and other financial services firms automate their credit analysis workflows. The Platform uses AI agents to ingest, classify, parse, and analyze borrower documents — including credit applications, bank statements, tax returns, invoices, and other financial records — and produces structured, decision-ready outputs such as credit memos, risk summaries, and KYB verification reports.

When Customers use the Platform, they submit or connect borrower and deal information to Kaaj for processing. Kaaj processes that information on behalf of and at the direction of Customers, as a service provider. Customers are responsible for their own data practices with respect to the individuals whose information they submit, including obtaining any required consents or authorizations.

3. Information We Collect

3.1 Information You Provide Directly

When you interact with our Website or register to use our Services, we collect:

• Contact and account information: your name, business name, email address, phone number, job title, and account credentials (username and password).
• Communications and inquiries: information you provide when you request a demo, submit a support ticket, apply for a job, or otherwise contact us.
• Job application information: if you apply for a role at Kaaj, your resume, work history, references, and other application materials.

3.2 Customer Data Processed on the Platform

When Customers use the Platform, they submit borrower and deal information for AI-assisted processing. Depending on the Customer's use case and the documents submitted, this may include:

• Business identification information: legal entity names, EINs, Secretary of State filing data, business addresses, officer and owner details.
• Loan and deal information: loan amounts, purpose, collateral details, and deal status.
• Financial documents: bank statements, tax returns, financial statements, and similar records.
• Credit report data: with the Customer's authorization, soft credit pulls obtained through our credit reporting agency partner, CRS.
• Credit applications and supporting materials: completed credit applications, invoices, equipment details, and supplementary documents submitted by or about borrowers.
• Email content and attachments: when Customers use Kaaj's email forwarding feature to route deal packages to the Platform, this may include email body text and attachments.
• Public records: Secretary of State filings, business registry data, address verification signals, and other publicly available business information retrieved by Kaaj's verification agents.

Access to credit report data through CRS requires lenders and brokers to complete CRS's own FCRA-compliant onboarding process. Kaaj does not independently pull or use credit reports; Customers remain responsible for their own compliance with the Fair Credit Reporting Act and any other applicable credit reporting laws.

Kaaj processes Customer Data as a service provider acting on Customer instructions. Kaaj does not use Customer Data for purposes beyond providing and supporting the Services, as further described in Section 4.

3.3 Usage and Technical Data

When you access our Website or Platform, we and our service providers automatically collect log data (server logs, error reports, and other diagnostic information), and, depending on the features you use, may also collect the following:

• Device and browser information: IP address, browser type and version, operating system, device identifiers, and internet service provider.
• Usage data: pages viewed, features accessed, navigation paths, time spent, clickstream data, and referring website.

We collect this data using:

• Cookies: small text files stored on your device that help us recognize returning users, remember preferences, and analyze usage. You can configure your browser to refuse cookies, though some features may not work properly without them. We do not currently respond to browser Do Not Track signals or Global Privacy Control (GPC) signals.
• Pixel tags and web beacons: small electronic files embedded in pages or emails that help us measure traffic and engagement.
• Analytics tools: we use third-party analytics services, including Google Analytics, to help us understand how users interact with our Website. You can opt out of Google Analytics data collection by installing the opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

3.4 Information from Other Sources

We may receive information about you or your organization from publicly available sources, business directories, or third-party partners, which we may combine with information we collect directly.

4. How We Use Information

4.1 Use of Account and Contact Information

We use information collected directly from users and prospects for the following purposes:

• Providing and operating the Services, including authenticating users, processing and responding to requests, and maintaining the Platform.
• Communicating with you about your account, including service notices, security alerts, and policy updates.
• Responding to demo requests, support inquiries, and other communications.
• Sending marketing communications about our products and services, where you have not opted out.
• Processing job applications and evaluating candidates.
• Improving and developing our Services, including analyzing usage trends and testing new features.
• Detecting and preventing fraud, abuse, security incidents, and unauthorized access.
• Complying with legal obligations and enforcing our agreements.
• Generating aggregated, de-identified data for internal analytics, industry research, and product development.

4.2 Use of Customer Data

Kaaj processes Customer Data solely to provide and support the Services purchased by each Customer. Permitted uses include:

• Parsing, classifying, and extracting structured information from submitted documents.
• Running KYB verification checks against public records and business databases.
• Analyzing bank statements and financial records to generate cash flow summaries and credit signals.
• Generating credit memos, risk summaries, and other outputs for Customer review.
• Detecting potential document fraud or data inconsistencies.
• Syncing structured outputs to Customer CRM, LOS, or other connected systems.
• Providing customer support and investigating service issues.
• Complying with legal obligations applicable to Kaaj as a service provider.

4.3 Restrictions on AI Training

Kaaj does not use Customer Data — including borrower documents, financial records, or any deal-specific information — to train, fine-tune, or otherwise improve Kaaj's or any third party's AI or machine learning models, except as expressly authorized in the applicable Customer agreement. Aggregated, de-identified insights derived from usage patterns (not linked to any individual or Customer) may be used to improve platform performance.

5. How We Share Information

We do not sell personal information. We may share information in the following circumstances:

5.1 Service Providers

We share information with third-party vendors and contractors who help us operate and deliver the Services. These include cloud infrastructure providers, analytics services, security tools, and customer support platforms. Service providers are contractually required to protect information and use it only for the purposes we specify.

5.2 AI Model Providers

The Platform uses third-party AI services to power certain features. Information submitted to the Platform may be processed by these AI providers subject to data processing agreements. Customer Data shared with AI providers will not be used to train those providers' AI models.

5.3 Affiliates

We may share information with our affiliate entities for the purposes described in this policy.

5.4 Legal and Safety Disclosures

We may disclose information when required by law, regulation, court order, or government authority, or when we believe disclosure is necessary to: (a) comply with applicable legal obligations; (b) protect our rights, property, or safety; (c) protect the rights, property, or safety of our users or the public; or (d) detect, prevent, or address fraud, security, or technical issues.

5.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, information we hold may be transferred as part of that transaction. We will provide notice of any such change that materially affects this Privacy Policy.

5.6 With Your Consent

We may share information for other purposes with your consent.

6. Automated Decision-Making and AI Processing

The Platform uses automated AI agents to analyze documents, verify business information, and generate credit analysis outputs. These automated outputs are designed to assist — not replace — human underwriters. Kaaj's platform does not make final credit or lending decisions; those decisions remain with Customers and their authorized personnel.

If you have questions about how automated processing works within the Platform, please contact us at data-privacy@kaaj.ai.

7. Information Security

Kaaj has implemented administrative, technical, and physical safeguards designed to protect the information we hold against unauthorized access, use, disclosure, alteration, and destruction. Our security measures include:

• Encryption of data in transit and at rest.
• Role-based access controls and least-privilege access policies.
• Audit logging and monitoring.
• Regular security assessments and vulnerability management.
• Employee security training.

No security system can guarantee complete protection against all threats. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at data-privacy@kaaj.ai.

In the event of a security incident affecting personal information, we will notify affected parties in accordance with applicable breach notification laws.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the type and sensitivity of the information, our legal and contractual obligations, and Customer instructions.

For Customer Data, Kaaj retains certain personal information — including name, email address, social security number, and date of birth — for a rolling period of no more than 30 days from the date the information is entered into or processed by the Platform. The underlying analysis, underwriting outputs, and other information derived from it remain accessible to the Customer for the duration of the applicable agreement.

Where a Customer agreement specifies deletion or return timelines upon termination, Kaaj will comply with those terms. Absent such terms, Kaaj may continue to retain Customer Data (other than the personal information described above, which is purged on the rolling basis noted) for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements.

9. Your Privacy Choices and Rights

9.1 Updating Your Information

If you would like to update or correct your personal information, please contact us at data-privacy@kaaj.ai.

9.2 Marketing Opt-Out

You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing message we send or by contacting us to request removal from our email distribution list. Opting out of marketing will not affect service-related or transactional communications.

9.3 Cookies and Tracking

You can manage cookies through your browser settings or by using the cookie preference tool on our Website. Note that disabling certain cookies may affect the functionality of our Services. You may also opt out of targeted advertising by visiting the Network Advertising Initiative opt-out page at https://optout.networkadvertising.org or the Digital Advertising Alliance opt-out page at https://optout.aboutads.info.

9.4 General Privacy Rights

Depending on where you are located, you may have the right to: access the personal information we hold about you; request deletion of your personal information; restrict or object to certain processing; and receive a portable copy of your data. To submit a privacy request, please contact us at data-privacy@kaaj.ai. We will respond consistent with applicable law and will not discriminate against you for exercising your rights.

10. California Privacy Rights (CCPA)

This section applies to residents of California and supplements the information in this Privacy Policy. It is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the "CCPA").

10.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information from California residents:

• Identifiers: name, email address, account username, and similar identifiers.
• Professional or employment-related information: job title, company name, and work contact details.
• Commercial information: records of services purchased and transaction history.
• Inferences: preferences and characteristics inferred from usage patterns.

10.2 Purposes of Collection and Disclosure

We collect personal information for the business purposes described in Section 4 of this policy. In the preceding 12 months, we have disclosed personal information to service providers, analytics providers, and legal authorities for operational business purposes.

10.3 No Sale of Personal Information

We do not sell personal information and have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of minors under 16 years of age.

10.4 Your CCPA Rights

California residents may submit the following requests:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: request deletion of personal information we collected from you, subject to certain exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt-Out of Sharing: opt out of sharing of personal information for cross-context behavioral advertising, if applicable.
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.

To submit a request, please contact us at data-privacy@kaaj.ai or by mail at the address in Section 16. We will verify your identity before fulfilling your request and will respond within the timeframes required by applicable law. You may designate an authorized agent to make requests on your behalf; we may require proof of the agent's authorization.

11. Nevada Privacy Rights

We do not sell personal information as defined under Nevada Revised Statutes Chapter 603A. If you are a Nevada resident and have questions, please contact us at data-privacy@kaaj.ai with the subject line "Nevada Do Not Sell Request."

12. International Data Transfers

Kaaj is based in the United States, and the Services are primarily designed for U.S.-based customers. Information we collect or process may be stored and processed in the United States or in other countries where our service providers operate.

If you are located outside the United States and use our Services, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your home jurisdiction.

13. Third-Party Services and Links

Our Services may contain links to third-party websites or integrate with third-party tools such as CRM and LOS platforms (e.g., Salesforce, HubSpot, Microsoft Dynamics). This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy or security practices. We encourage you to review the privacy policies of any third-party services you connect to or use in conjunction with our Platform.

14. Children's Privacy

Our Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from minors. If we learn that we have inadvertently collected information from a minor, we will delete it promptly. If you believe we may have information from or about a minor, please contact us at data-privacy@kaaj.ai.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on our Website and update the "Last updated" date at the top of this document. For material changes, we will provide additional notice as required by applicable law — for example, by email or by displaying a prominent notice on our Website. We encourage you to review this policy periodically.

16. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our privacy practices, please contact us:

Kaaj Technologies, Inc.
Attention: Privacy
Address: 95 Third Street, 2nd Floor, San Francisco, CA 94103
Email: data-privacy@kaaj.ai
Website: https://kaaj.ai