RightsGrid Legal

Privacy Policy

Version 1.0·Effective April 20, 2026

RIGHTSGRID PRIVACY POLICY

Version 1.0 | Effective Date: April 20, 2026

This Privacy Policy ("Policy") describes how RightsGrid LLC, a Wyoming limited liability company ("RightsGrid," "we," "us," or "our"), collects, uses, stores, shares, and protects information about you when you access or use the RightsGrid platform, website, and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

This Policy is incorporated by reference into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

────────────────────────────────────────────────────────────────────────
1. INFORMATION WE COLLECT
────────────────────────────────────────────────────────────────────────

1.1 Information You Provide Directly. We collect information you voluntarily provide when you register for an account, submit a Rights Declaration, complete a Property Profile, or contact us. This includes:

(a) Account Information: your full name, email address, and any optional display name or account preferences;

(b) Property Information: property address, normalized address, geographic coordinates (latitude and longitude), jurisdiction, county, city, and state, as derived from geocoding services applied to your submitted address;

(c) Rights Declaration Data: your declared global stance (permit, monetize, or prohibit), per-category rights overrides, written conditions, notes, and monetization interest signals you provide;

(d) Property Profile Data: optional structured information about your property including property type, infrastructure characteristics, seasonal constraints, flight path preferences, operating hour preferences, trusted operator types, and comfort level with autonomous interaction;

(e) Legal Acceptance Data: timestamp, terms version, privacy policy version, IP address, and browser user agent recorded at the time you accept our Terms of Service when submitting a Rights Declaration;

(f) Support and Communications Data: any messages, attachments, or information you send us through the support request system or by email;

(g) Soft Registration Data: if you use the soft registration or preview flow without creating an account, we collect your name, email, phone number (optional), property address, and rights preference selections along with a session identifier and hashed IP address for abuse prevention.

1.2 Information Collected Automatically. When you access the Service, we automatically collect certain technical information, including:

(a) Log Data: IP address, browser type and version, operating system, referring URLs, pages visited, and timestamps of your interactions with the Service;

(b) Device Information: device type, screen resolution, and general location derived from IP address;

1.3 Information from Third Parties. We may receive information from third-party services we integrate with to provide the Service, including:

(a) Geocoding Services: when you submit a property address, we pass it to a geocoding provider (currently Google Maps) to derive standardized coordinates, jurisdiction, county, city, and state. Please review Google's privacy practices at https://policies.google.com/privacy;

(b) Authentication Providers: if you register or log in through a third-party identity provider, we receive basic profile information (such as name and email) from that provider consistent with your permissions.

────────────────────────────────────────────────────────────────────────
2. HOW WE USE YOUR INFORMATION
────────────────────────────────────────────────────────────────────────

2.1 To Operate and Provide the Service. We use your information to:

(a) Create and maintain your account;

(b) Process and store your Rights Declarations and Property Profiles;

(d) Enable you to search the public registry;

(e) Power AI-assisted property scan features;

(f) Facilitate the agent-assisted draft preparation and owner-review workflow;

(g) Respond to your support requests and communications.

2.2 To Maintain Registry Integrity. We use your information to:

(a) Maintain an accurate, auditable, and tamper-evident record of all declarations submitted to the RightsGrid registry;

(b) Detect and prevent fraudulent, unauthorized, or duplicate declarations;

(d) Preserve historical declaration records and certificate audit trails even if you update or delete your current declaration.

2.3 For Legal Compliance and Protection. We use your information to:

(a) Comply with applicable laws, regulations, and legal obligations;

(b) Respond to lawful requests from government authorities;

(d) Protect the rights, property, and safety of RightsGrid, our users, and the public.

2.4 To Improve the Service. We use aggregated or de-identified information to analyze usage patterns, monitor Service performance, identify areas for improvement, and develop new features. We do not use individual declaration content for model training without your separate explicit consent.

2.5 To Communicate with You. We may use your email address to:

(a) Send transactional messages related to your account and declarations (e.g., certificate issuance confirmations, ownership dispute notifications, draft review requests);

(b) Send service announcements, security alerts, and policy update notices;

(c) Send optional product updates or industry newsletters if you have opted in. You may opt out of non-transactional emails at any time through your Profile settings or by following the unsubscribe link in any marketing email.

────────────────────────────────────────────────────────────────────────
3. LEGAL BASIS FOR PROCESSING (EEA/UK USERS)
────────────────────────────────────────────────────────────────────────

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

(a) Contractual Necessity: processing required to provide you with the Service and fulfill our obligations under the Terms of Service;

(b) Legitimate Interests: processing necessary for fraud prevention, registry integrity, security, and improving the Service, where our interests do not override your rights;

(d) Consent: where we rely on your consent (such as for optional marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

────────────────────────────────────────────────────────────────────────
4. HOW WE SHARE YOUR INFORMATION
────────────────────────────────────────────────────────────────────────

4.1 We Do Not Sell Your Personal Information. RightsGrid does not sell, rent, or trade your personal information to third parties for their own marketing purposes.

4.2 Public Registry Data. Certain data is intentionally made available to the public as part of the registry's function. Public data is limited to:

(a) Property address;

(b) Global rights stance (permit, monetize, or prohibit);

(d) Jurisdiction.

Public data explicitly does NOT include: owner name or identity, email address, per-category rights details, operating conditions, monetization terms, pricing signals, IP addresses, or any other personally identifying information. Owners who set their property to private access level will not appear in public search results.

4.3 Service Providers. We share information with third-party vendors and service providers that perform services on our behalf under confidentiality obligations and data processing agreements, including:

(a) Cloud infrastructure and hosting providers;

(b) Geocoding and mapping services;

(d) Analytics and monitoring tools;

(e) AI and language model providers used for property scan features.

These providers are permitted to use your information only as necessary to provide services to RightsGrid and are contractually prohibited from using it for their own independent purposes.

4.4 Authorized Operator and API Partners. Parties who have entered into a separate operator or partner agreement with RightsGrid may receive access to structured registry data through authorized API channels. Such access is governed by the terms of their partner agreement, is strictly limited in scope, and does not include owner identity, per-category rights details, or monetization conditions beyond what RightsGrid determines is appropriate for the applicable partnership tier.

4.5 Business Transfers. If RightsGrid is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

4.6 Legal Requirements. We may disclose your information if required to do so by law or in the good-faith belief that such disclosure is necessary to: comply with a legal obligation or court order; protect and defend the rights or property of RightsGrid; prevent or investigate possible wrongdoing in connection with the Service; protect the personal safety of users or the public; or protect against legal liability.

4.7 With Your Consent. We may share your information with third parties for purposes not described in this Policy when we have your explicit consent to do so.

────────────────────────────────────────────────────────────────────────
5. DATA RETENTION
────────────────────────────────────────────────────────────────────────

5.1 Registry Records. Rights Declarations, Rights Certificates, and associated legal acceptance logs are retained indefinitely as part of the permanent, auditable registry record. These records serve an ongoing regulatory and evidentiary function and may not be purged even if you delete your account.

5.2 Account Data. If you delete your account, we will delete or de-identify your personal account information (name, email, account preferences) within a reasonable time, subject to our obligation to retain registry records as described above.

5.3 Support Data. Support request communications are retained for a period of three (3) years following resolution, after which they may be deleted or de-identified.

5.4 Log Data. Server logs and automatically collected technical data are retained for up to ninety (90) days unless a longer retention period is required for security investigation or legal compliance.

5.5 Soft Registration Data. Soft registration leads that were never converted to a full account are retained for a period of twelve (12) months from submission, after which they are automatically purged.

────────────────────────────────────────────────────────────────────────
6. DATA SECURITY
────────────────────────────────────────────────────────────────────────

6.1 Security Measures. We implement commercially reasonable administrative, technical, and physical safeguards to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include encrypted data transmission over TLS, access controls limiting data access to authorized personnel, secure cloud infrastructure with audit logging, and role-based permissions within the Service.

6.2 No Absolute Security. No method of transmission over the internet or electronic storage is one hundred percent (100%) secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security. You use the Service at your own risk.

6.3 Breach Notification. In the event of a security breach that affects your personal information in a way that creates a material risk of harm, we will notify you as required by applicable law.

────────────────────────────────────────────────────────────────────────
7. COOKIES AND TRACKING TECHNOLOGIES
────────────────────────────────────────────────────────────────────────

7.1 Types of Cookies We Use. We use the following types of cookies and similar technologies:

(a) Essential Cookies: required for the Service to function, including authentication session tokens and CSRF protection tokens. These cannot be disabled without disrupting core functionality;

(b) Functional Cookies: used to remember your preferences, such as display settings and mode selections;

(c) Analytics Cookies: used to understand how users interact with the Service, including which features are used and how often. We use this data in aggregate, de-identified form.

7.2 Managing Cookies. You may disable cookies through your browser settings. Disabling essential cookies will prevent you from logging in and using core Service features. Disabling analytics cookies will not affect your ability to use the Service.

7.3 Do Not Track. We do not currently respond to browser "Do Not Track" signals.

────────────────────────────────────────────────────────────────────────
8. YOUR PRIVACY RIGHTS
────────────────────────────────────────────────────────────────────────

8.1 General Rights. Depending on your jurisdiction, you may have the following rights with respect to your personal information:

(a) Access: the right to request a copy of the personal information we hold about you;

(b) Correction: the right to request correction of inaccurate or incomplete personal information;

(c) Deletion: the right to request deletion of your personal information, subject to our legal obligations and the permanent registry record exceptions described in Section 5.1;

(d) Data Portability: the right to receive a copy of your personal information in a structured, machine-readable format;

(e) Objection and Restriction: the right to object to or request restriction of certain processing activities;

(f) Withdrawal of Consent: where processing is based on consent, the right to withdraw consent at any time without affecting prior lawful processing.

8.2 California Residents. If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), including the right to know, the right to delete, the right to correct, the right to opt out of sale (we do not sell personal information), and the right to non-discrimination for exercising your rights. To submit a verifiable consumer request, contact us using the information in Section 11.

8.3 EEA and UK Residents. If you are located in the EEA or UK, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR as applicable. You also have the right to lodge a complaint with your applicable supervisory authority.

8.4 Exercising Your Rights. To exercise any of the above rights, please contact us at privacy@rightsgrid.tech. We will respond to verifiable requests within the timeframe required by applicable law. We may require you to verify your identity before processing your request. Please note that certain rights are subject to exceptions, including our obligation to retain permanent registry records.

────────────────────────────────────────────────────────────────────────
9. CHILDREN'S PRIVACY
────────────────────────────────────────────────────────────────────────

The Service is not directed to, and we do not knowingly collect personal information from, individuals under the age of eighteen (18). If we become aware that we have collected personal information from a minor without verifiable parental consent, we will take steps to delete that information. If you believe we may have collected information from a minor, please contact us at privacy@rightsgrid.tech.

────────────────────────────────────────────────────────────────────────
10. INTERNATIONAL DATA TRANSFERS
────────────────────────────────────────────────────────────────────────

RightsGrid is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you acknowledge and consent to this transfer. Where required by applicable law, we implement appropriate safeguards for international transfers, such as standard contractual clauses approved by the European Commission.

────────────────────────────────────────────────────────────────────────
11. CHANGES TO THIS POLICY
────────────────────────────────────────────────────────────────────────

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will notify you by posting the updated Policy on the Service and updating the effective date, and, where required by law, by sending you an email notification. Your continued use of the Service after the effective date of a revised Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

────────────────────────────────────────────────────────────────────────
12. CONTACT INFORMATION
────────────────────────────────────────────────────────────────────────

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

RightsGrid LLC
Privacy & Legal
Email: privacy@rightsgrid.tech
Website: https://rightsgrid.tech

For EU/UK data subjects, our representative for GDPR purposes may be reached at the same contact address.