UHURA PRIVACY POLICY

Renterprise, LLC d/b/a Uhura

Effective Date: October 1, 2026 | Last Updated: October 1, 2026 | Version 2.0

This Privacy Policy explains how Renterprise, LLC, doing business as Uhura, collects, uses, discloses, transfers, retains, and protects personal information when you use the Uhura website, web app, downloadable apps, and related services, and the rights and choices available to you. Because Uhura translates your communications, the content of your messages, voice, and video calls must be processed by our systems and those of our service providers. Please read this Policy carefully.

Privacy at a Glance

This summary is provided for convenience only. The full Policy below controls.

• Who we are. Renterprise, LLC d/b/a Uhura ("Uhura," "we," "us," or "our"), 8 The Green #4000, Dover, DE 19901, United States, is the controller of personal information processed through the Service, except where we process information on behalf of a business customer.
• What we collect. Account and profile information; the content of the communications you send and receive (messages, voice, video, files) so that we can deliver and translate them; device, usage, and diagnostic data; payment and transaction records; support communications; and information from device permissions you grant.
• Translation requires processing. Your communications are encrypted in transit and at rest, but they are not end-to-end encrypted, because translation, captioning, and transcription are performed on our servers and those of our technology providers.
• No sale; no training on your conversations. We do not sell your personal information. We do not use the content of your private communications to train general-purpose artificial-intelligence models, and our providers are contractually prohibited from doing so.
• Where your data goes. We are based in the United States, and personal information is processed in the United States and other countries where we and our providers operate. We participate in the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, and use the additional safeguards described in Section 9.
• Your rights. Depending on where you live, you may have rights to access, correct, delete, or port your information, to object to or restrict processing, to opt out of certain uses, and to lodge a complaint with a regulator. See Sections 12 and 13.
• Children. Uhura is not directed to children under 13 (or the higher age required where you live).
• Contact. support@uhura.ai.

Contents

1. 1. Introduction and Scope
2. 2. Information We Collect
3. 3. How We Handle Communications Content, Translation, and AI
4. 4. How We Use Personal Information
5. 5. Legal Bases for Processing
6. 6. How We Disclose Personal Information
7. 7. We Do Not Sell Personal Information; Advertising
8. 8. Cookies and Similar Technologies
9. 9. International Data Transfers
10. 10. Data Retention
11. 11. Security
12. 12. Your Rights and Choices
13. 13. Regional Privacy Disclosures
14. 14. Children's Privacy
15. 15. Business Customers and Processor Activities
16. 16. Third-Party Services, Links, and Platforms
17. 17. Security Incidents and Breach Notification
18. 18. Changes to This Policy
19. 19. How to Contact Us

1. Introduction and Scope

1.1 Who We Are

Renterprise, LLC is a Delaware limited liability company doing business as Uhura. Our principal business address is 8 The Green #4000, Dover, DE 19901, United States. Our address for legal notices and service of process is 8 The Green STE A, Dover, DE 19901, United States. Our privacy contact is support@uhura.ai.

1.2 What This Policy Covers

This Policy applies to personal information that we process in connection with: (a) the Uhura websites, including uhura.ai, uhura.chat, and any other domain or subdomain we operate (the "Website"); (b) the Uhura progressive web application and any browser-based version of Uhura (the "Web App"); (c) the Uhura downloadable applications for mobile, tablet, desktop, and other devices, whether obtained from an app store or marketplace, from our Website, or otherwise (the "Apps"); (d) our messaging, voice, video, translation, transcription, and captioning features; (e) our customer support, sales, marketing, and social-media interactions; and (f) any other product or service that links to this Policy (together, the "Service"). It applies to registered users, guests who join a session without an account, visitors to the Website, and individuals who contact us.

1.3 What This Policy Does Not Cover

This Policy does not apply to: (a) third-party websites, apps, or services that may be linked from or integrated with the Service, including app stores, sign-in providers, and payment processors, which have their own privacy policies; (b) personal information that we process solely on behalf of a Business Customer (defined in Section 15), which is governed by our agreement with that Business Customer and its privacy policy; or (c) information about our employees and contractors, which is covered by separate notices.

1.4 Our Roles

For most processing described in this Policy, Renterprise is the "controller" (or "business," under U.S. state laws) that determines the purposes and means of processing. Where a Business Customer uses the Service to communicate with its own customers, patients, clients, or end users, the Business Customer is the controller of those communications, and we act as its "processor" (or "service provider"), as described in Section 15.

1.5 Key Definitions

"Personal information" (or "personal data") means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identifiable individual. "Communications Content" means the text messages, voice, audio, video, images, files, and other content that users transmit through the Service. "Language Outputs" means translations, transcripts, captions, synthesized speech, and similar automated outputs generated from Communications Content.

2. Information We Collect

2.1 Information You Provide to Us

• Account and registration information: name, display name or username, email address, telephone number, password or other authentication credentials, profile photo, country or region, time zone, preferred and interface languages, date of birth or age confirmation where required, and account settings.
• Contacts and invitations: if you choose to sync your device contacts or invite others, the names, phone numbers, and email addresses of the people you invite or select. You are responsible for having the right to share this information with us. We use it only to help you connect with those people and to send the invitations you request.
• Communications Content: the messages, voice, video, images, files, reactions, group names, and other content you send and receive through the Service, including Language Outputs generated from that content and any recordings, transcripts, or exports you choose to create.
• Session information: language selections, session names and configurations, participant lists, and the choices you make as a Host or participant.
• Business account information: if you register a business or organization account, your business name, address, website, industry, tax or registration identifiers, and the contact details of administrators and Authorized Users.
• Payment and transaction information: billing name and address, payment method type, the last four digits of a card number, transaction history, subscription status, and your Credit and Wallet balances and usage records. Full payment card details are collected and processed by our third-party payment processors or by the app store through which you purchase, and are not stored by us.
• Support and correspondence: the content of your communications with us, including support requests, feedback, survey responses, dispute notices, privacy requests, and any attachments you include.
• Promotions and events: information you provide when you participate in a promotion, referral program, beta program, webinar, or similar activity.

2.2 Information We Collect Automatically

• Device and technical information: device type and model, operating system and version, app version, browser type and version, language and locale settings, screen resolution, time zone, mobile carrier, network type, IP address, push-notification tokens, and device, app, or installation identifiers.
• Usage and session metadata: when you register, sign in, and use the Service; the features you use; sessions and calls you create or join (including start and end times, duration, participants' account identifiers, communication mode, and language pairs); Credits consumed; messages sent and received (metadata such as timestamps and recipients, as distinct from content); and interactions with notifications and in-Service messages.
• Call-quality and performance data: connection statistics, latency, jitter, packet loss, codec information, audio and video quality metrics, and similar diagnostics used to operate and improve real-time communications.
• Log and diagnostic data: server logs, error reports, crash reports, and security logs, which may include IP addresses, timestamps, device information, and the actions taken immediately before an error.
• Approximate location: we infer your approximate location (such as country, region, or city) from your IP address for purposes such as language defaults, localization, fraud prevention, compliance with legal restrictions, and tax calculation. We do not collect precise geolocation from your device unless you expressly grant a location permission for a feature that requires it, and we currently do not request such a permission.
• Cookies and similar technologies: described in Section 8.

2.3 Information We Receive from Other Sources

• App stores and platforms: when you download the Apps or make an in-app purchase, the app store (such as the Apple App Store or Google Play) provides us with purchase confirmations, subscription status, and limited transaction identifiers. We do not receive your full payment card details from app stores.
• Sign-in providers: if you register or sign in using a third-party account (such as Apple, Google, or Microsoft), that provider shares information with us as authorized by you and by its settings, typically your name, email address, and a unique identifier.
• Other users: other users may provide information about you, for example when they invite you to a session, add you to a group, sync contacts that include your details, or report a concern about you.
• Business Customers: if you use Uhura through an account provisioned by a Business Customer (for example, your employer or a business you communicate with), that Business Customer may provide your name, work contact details, role, and account settings.
• Payment processors and fraud-prevention partners: confirmation of payment, chargeback and dispute information, and risk signals that help us detect fraud.
• Publicly available and commercial sources: limited information, such as business contact details for prospective Business Customers, and sanctions and restricted-party screening data.

2.4 Device Permissions in the Downloadable Apps

The Apps request certain device permissions in order to provide features. You can grant or revoke these permissions at any time through your device settings; some features will not work without them.

2.5 Sensitive Information

We do not require you to provide sensitive personal information (such as information about your health, racial or ethnic origin, religious or philosophical beliefs, political opinions, sexual orientation, trade-union membership, genetic or biometric data, or precise geolocation) to use the Service. However, Communications Content may incidentally include sensitive information that you or other participants choose to share. We process such content only as necessary to deliver and translate the communication, to secure the Service, and to comply with law, and we do not use it to infer characteristics about you or for marketing. Voice and video streams are processed for speech recognition and translation, not to identify you biometrically, and we do not create voiceprints or facial templates. Please use discretion when sharing sensitive information through any communication service.

2.6 Information About Others

If you provide us with information about another person (for example, by inviting them, syncing contacts, or including their information in a message), you confirm that you have the right to do so and that you have informed them, where required, of how their information will be used.

3. How We Handle Communications Content, Translation, and AI

3.1 Server-Side Processing and Encryption

To translate, caption, and transcribe your communications, the Service must process Communications Content on our servers and on the systems of our speech-recognition and translation providers. For this reason, Communications Content is not end-to-end encrypted. We protect Communications Content with encryption in transit (using industry-standard transport-layer security) and encryption at rest, and we limit access to it through role-based access controls, logging, and other safeguards. Our personnel do not access the content of your communications except where necessary to operate the Service, to investigate abuse, security, or legal issues, to respond to your support request, or as required by law.

3.2 Text Messages and Chat History

Text messages, their translations, and shared files are stored on our servers so that we can deliver them to recipients, synchronize them across your devices, and display your conversation history. Messages remain stored until you delete them, until the conversation or account is deleted, or until the retention period described in Section 10 expires, whichever is earliest. When you delete a message, it is removed from your view and from our active systems within a short period; copies that have already been delivered to other participants may remain in their conversation history. Undelivered messages are deleted from our servers after 30 days.

3.3 Voice and Video Calls

Voice and video calls are transmitted in real time between participants through our real-time communications infrastructure. During a translated call, audio is streamed to speech-recognition and translation engines to produce captions, transcripts, or translated speech. These streams are processed transiently and are not recorded or stored by us, except: (a) brief technical buffering required for transmission and processing; (b) where you or another participant uses a recording, transcript, or similar feature (see Section 3.5); or (c) where the Service clearly discloses otherwise. We retain call metadata (such as participants, start and end times, duration, and quality metrics) as described in Section 10.

3.4 Translations, Captions, and Transcripts

Translations of text messages are stored alongside the original messages as part of your conversation history. Live captions displayed during calls are transient and are not retained after the call unless a transcript feature is used. Where a transcript feature is used, the transcript is stored in the account of the user who created it and is subject to that user's deletion controls and our retention schedule.

3.5 Recording and Saved Transcripts

Where the Service offers a recording, save, transcript, or export feature, it is initiated by a user, not by us. The user who initiates the feature is responsible for complying with applicable recording and consent laws and for informing other participants. The Service may display an indicator when such a feature is active. Recordings and saved transcripts are stored in the initiating user's account, may be accessible to that user and (for business accounts) to that user's administrators, and are retained until deleted by the user or until the account is closed, subject to Section 10.

3.6 Artificial Intelligence and Automated Processing

Language Outputs are produced by automated speech-recognition, machine-translation, language-identification, and text-to-speech technologies, some of which are provided by third-party technology providers (currently including Microsoft Azure speech and translation services) under contracts that restrict their use of your data. We use these technologies only to provide the Service's features and to secure and support the Service. We do not use the content of your private communications to train general-purpose artificial-intelligence or machine-learning models, and our providers are contractually prohibited from using your Communications Content to train or improve their own models or for any purpose other than providing services to us. We may use aggregated, de-identified usage statistics (such as language-pair frequency, latency, and error rates, without Communications Content) to improve service quality. We do not make decisions about you using solely automated processing that produce legal or similarly significant effects.

3.7 Safety, Abuse, and Security Scanning

To protect users and the Service, we may use automated tools to detect spam, malware, fraud, account takeover, and other abuse, and to detect and report child sexual abuse material (for example, through hash-matching against known content) as required or permitted by law. Automated scanning is limited to these safety and security purposes. Where automated tools flag content, a small number of trained personnel may review the flagged content to determine whether action is required. We may also review content when a user reports a conversation to us.

4. How We Use Personal Information

We use personal information for the following purposes:

• Providing the Service: creating and managing your account; authenticating you; delivering messages, calls, and video; generating Language Outputs; synchronizing your conversations across devices; operating sessions, groups, and business channels; and enabling the features you choose to use.
• Operating Credits, subscriptions, and payments: administering Free Registration Credits, Purchased Credits, Wallet balances, subscriptions, metering, invoicing, taxes, and payment processing, and detecting and preventing payment fraud and chargeback abuse.
• Customer support: responding to your inquiries, troubleshooting problems, and handling complaints and disputes.
• Communicating with you: sending transactional, service, security, billing, and legal notices, and, subject to your choices, sending marketing communications about Uhura features, offers, and events.
• Personalization: remembering your language and interface preferences, recent contacts, and settings.
• Safety, security, and integrity: detecting, investigating, and preventing fraud, abuse, spam, harassment, security incidents, and violations of our Terms of Use; protecting the rights, property, and safety of users, Renterprise, and others; and enforcing our agreements.
• Research, analytics, and improvement: understanding how the Service is used, measuring the performance and quality of calls and translations, diagnosing errors, developing new features, and improving the Service, using aggregated or de-identified data wherever practicable.
• Legal compliance: complying with applicable laws, regulations, legal process, and governmental requests; meeting tax, accounting, and record-keeping obligations; screening against sanctions lists; and establishing, exercising, or defending legal claims.
• Corporate transactions: evaluating and completing a merger, acquisition, financing, reorganization, or sale of assets.
• With your consent: for any other purpose that we describe to you at the time of collection and to which you consent.

We may de-identify or aggregate personal information so that it can no longer reasonably be linked to you. We maintain and use de-identified data only in de-identified form, do not attempt to re-identify it (except to test the effectiveness of our de-identification), and contractually require recipients to do the same.

5. Legal Bases for Processing

Where the EU or UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, or a similar law applies, we rely on the following legal bases:

6. How We Disclose Personal Information

6.1 Other Users and Participants

The Service is a communications platform. When you use it, other participants receive the Communications Content you send, together with its translation, and may see your display name, profile photo, preferred language, online or typing status, and other profile information you make visible. If you join a session created by a Host, the Host may see your participation details. Other participants may save, screenshot, forward, or record content you send, subject to applicable law and our Terms of Use; we do not control what other users do with content you send them.

6.2 Business Customers

If you communicate with a business through its Uhura business account, that business receives your Communications Content and may retain and use it under its own privacy policy. If you use Uhura through an account provisioned by a Business Customer, that Business Customer's administrators may be able to access your account information, usage data, and, where features allow, Communications Content associated with the business account.

6.3 Service Providers

We disclose personal information to third-party service providers that process it on our behalf and under our instructions, for the purposes described in this Policy. These providers are bound by contracts that restrict their use of personal information to providing services to us and require them to protect it. Categories of providers include:

A current list of our principal sub-processors for Business Customers is available on request at support@uhura.ai.

6.4 Affiliates

We may disclose personal information to our current or future affiliates, subsidiaries, and parent companies, which will process it consistently with this Policy.

6.5 Legal, Safety, and Compliance Disclosures

We may disclose personal information, including Communications Content, where we believe in good faith that disclosure is reasonably necessary to: (a) comply with applicable law, regulation, legal process, or a governmental request, including requests from law-enforcement and regulatory authorities in the United States and other countries; (b) enforce our Terms of Use and other agreements, including investigating potential violations; (c) detect, prevent, or address fraud, abuse, security, or technical issues; (d) protect the rights, property, or safety of Renterprise, our users, or the public, including to prevent death or serious physical harm; or (e) report child sexual abuse material to the National Center for Missing & Exploited Children or equivalent authorities, as required by law. Where permitted by law and consistent with our policies, we will attempt to notify you of requests for your information, and we will challenge requests that we believe are overbroad or unlawful.

6.6 Business Transfers

If we are involved in a merger, acquisition, financing, due diligence, reorganization, bankruptcy, receivership, dissolution, sale of all or a portion of our assets, or transition of the Service to another provider, personal information may be disclosed to the counterparties and their advisers and transferred as one of the business assets, subject to standard confidentiality arrangements. The successor will be bound by this Policy unless and until it is changed in accordance with Section 18.

6.7 With Your Consent or at Your Direction

We disclose personal information to third parties when you direct us to do so or otherwise consent, for example when you connect a third-party service to your account, share content to another platform, or authorize an integration.

6.8 Aggregated and De-identified Information

We may disclose aggregated or de-identified information that cannot reasonably be used to identify you, such as usage statistics and language-pair trends, for any purpose.

7. We Do Not Sell Personal Information; Advertising

We do not sell personal information for money, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under California law or the comparable "targeted advertising" definitions in other U.S. state laws. We do not sell or share the personal information of anyone under 16. We do not display third-party advertising in the Service, and we do not permit third-party advertising networks to collect information about you through the Service. If we ever change these practices, we will update this Policy in advance and provide the choices required by applicable law, including honoring opt-out preference signals.

We may send you marketing communications about Uhura by email, push notification, or in-Service message, subject to your consent where required by law and to your right to opt out at any time (Section 12.2).

8. Cookies and Similar Technologies

8.1 What We Use

We and our service providers use cookies, local storage, software development kits (SDKs), pixels, and similar technologies on the Website, Web App, and Apps. We use the following categories:

• Strictly necessary: authentication tokens, session management, security and fraud-prevention, load balancing, and remembering your consent choices. These cannot be switched off because the Service would not function without them.
• Functional: remembering your language, interface, and notification preferences, and other settings that improve your experience.
• Analytics and performance: understanding how the Service is used, measuring call and translation quality, and diagnosing crashes and errors, so that we can improve the Service. Where required by law, we use these only with your consent.

We do not use advertising or cross-site tracking cookies.

8.2 Your Choices

Where required by law, we will ask for your consent before placing non-essential cookies or similar technologies and will provide a mechanism to withdraw consent. You can also control cookies through your browser settings, although disabling cookies may affect the functionality of the Service. On mobile devices, you can limit certain SDK data collection through your operating system's privacy settings. We honor Global Privacy Control signals and similar opt-out preference signals as required by applicable law. We currently do not respond to browser "Do Not Track" signals, because there is no common industry standard for them.

9. International Data Transfers

9.1 Where We Process Information

We are headquartered in the United States, and personal information is processed and stored in the United States and in other countries where we or our service providers maintain facilities. Because the Service enables communication between people around the world, your Communications Content is also transmitted to the countries where your recipients are located. The data-protection laws of these countries may differ from those of your country.

9.2 EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework

Renterprise, LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Renterprise, LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom (and Gibraltar) in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Renterprise, LLC has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

• Data covered. The types of personal data we receive in reliance on the DPF, and the purposes for which we process them, are described in Sections 2 and 4. We disclose such data to the categories of third parties described in Section 6. You have the right to access your personal data and to limit its use and disclosure as described in Sections 12 and 13.1.
• Complaints and independent recourse. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Renterprise, LLC commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF should first contact Renterprise, LLC at support@uhura.ai or by mail at the address in Section 19. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Renterprise, LLC commits to refer unresolved complaints concerning our handling of personal data received in reliance on the DPF to [insert the independent recourse mechanism named in Renterprise's DPF certification record (for example, JAMS, BBB National Programs, or TrustArc) and its complaint-submission URL], an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your complaint to your satisfaction, please contact that provider for more information or to file a complaint. Its services are provided at no cost to you.
• Binding arbitration. For complaints regarding compliance with the DPF Principles that are not resolved by any of the other DPF mechanisms, you may, under certain conditions, invoke binding arbitration before the Data Privacy Framework Panel, as described in Annex I of the DPF Principles.
• Enforcement. The U.S. Federal Trade Commission has jurisdiction over Renterprise, LLC's compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
• Onward transfers. Renterprise, LLC remains responsible under the DPF Principles if a third-party agent that it engages to process personal data on its behalf does so in a manner inconsistent with the Principles, unless Renterprise proves that it is not responsible for the event giving rise to the damage.
• Public authorities. Renterprise, LLC may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

9.3 Other Transfer Safeguards

Where the DPF does not apply to a transfer (for example, transfers from countries other than the EU/EEA, the United Kingdom, or Switzerland; transfers to our service providers located outside the United States; or if the DPF is ever invalidated), we rely on other appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, and the Swiss-recognized versions of those instruments, together with supplementary measures where appropriate. Where we transfer personal information from other jurisdictions that regulate international transfers (such as Brazil, Canada, Japan, the Republic of Korea, Singapore, India, South Africa, and others), we rely on the mechanisms recognized under those laws, including contractual protections, consent where required, and transfer-impact assessments. You may request a copy of the relevant safeguards by contacting support@uhura.ai; some commercial terms may be redacted.

10. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, to comply with our legal obligations, to resolve disputes, to prevent fraud and abuse, and to enforce our agreements. Our standard retention periods are summarized below; we may retain information longer where required by law, legal hold, or an ongoing investigation, and shorter where you delete it.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access. These include encryption of data in transit and at rest; role-based access controls and the principle of least privilege; multi-factor authentication for administrative access; logging and monitoring; network segmentation and firewalls; secure software-development practices; vendor security assessments; employee training; and incident-response procedures. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential, enabling available security features such as multi-factor authentication, keeping your devices and apps up to date, and notifying us promptly at support@uhura.ai if you suspect unauthorized access to your account.

12. Your Rights and Choices

12.1 Account Controls

Through the Service you can: update your profile and account information; change your language, notification, and privacy settings; grant or revoke device permissions; block or report other users; delete individual messages and conversations; disconnect synced contacts; export certain content where export features are available; and delete your account. Deleting your account removes your profile and Communications Content from our active systems as described in Section 10, except for information we must retain for legal, security, billing, or dispute-resolution purposes and copies already delivered to other participants.

12.2 Marketing Communications

You can opt out of marketing emails by using the unsubscribe link in any marketing email, opt out of marketing push notifications through your device or in-Service settings, and opt out of marketing SMS by replying STOP or as otherwise instructed. We will continue to send transactional, service, security, and legal notices that are necessary to operate your account.

12.3 Privacy Rights

Depending on where you live and subject to applicable law, you may have the right to: (a) confirm whether we process your personal information and access it; (b) obtain a portable copy of personal information you provided to us; (c) correct inaccurate or incomplete information; (d) delete your personal information; (e) restrict or object to certain processing, including processing based on legitimate interests and processing for direct marketing; (f) withdraw consent where processing is based on consent; (g) opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do not currently engage in these activities); (h) limit the use of sensitive personal information; (i) not be subject to a decision based solely on automated processing that produces legal or similarly significant effects; (j) appeal a decision we make about your request; and (k) lodge a complaint with a data-protection authority or other regulator. Region-specific details are in Section 13.

12.4 How to Exercise Your Rights

You can exercise many rights directly through your account settings. For other requests, contact us at support@uhura.ai with the subject line "Privacy Request," or write to Renterprise, LLC, Attn: Privacy, 8 The Green STE A, Dover, DE 19901, United States. The current version of this Policy is always available at https://uhura.ai/privacy. Please specify the right you wish to exercise and the jurisdiction in which you reside.

• Verification. To protect your information, we will verify your identity before acting on a request, typically by confirming control of the email address or phone number associated with your account, and we may ask for additional information where necessary. We may decline requests that we cannot verify, that are manifestly unfounded or excessive, or that would adversely affect the rights of others.
• Authorized agents. Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly with us.
• Timing. We will respond within the time required by applicable law, generally within 30 days for requests under the GDPR and UK GDPR and within 45 days for requests under U.S. state privacy laws, which may be extended once where reasonably necessary and permitted, in which case we will inform you of the extension.
• Appeals. If we deny your request in whole or in part, you may appeal by replying to our response or by contacting support@uhura.ai with the subject line "Privacy Appeal." We will respond to appeals within the period required by applicable law and, if we deny the appeal, will tell you how to contact your regulator.
• No discrimination. We will not discriminate against you for exercising your privacy rights, such as by denying services, charging different prices, or providing a different level of quality, except as permitted by law.

13. Regional Privacy Disclosures

13.1 European Economic Area, United Kingdom, and Switzerland

• Controller. Renterprise, LLC d/b/a Uhura, 8 The Green #4000, Dover, DE 19901, United States, is the controller of your personal data.
• Representative. Renterprise has appointed DataRep as its Data Protection Representative in the EU/EEA (Article 27 GDPR) and in the United Kingdom (Article 27 UK GDPR). If you want to raise a question to Renterprise, or otherwise exercise your rights in respect of your personal data, you may contact DataRep by: (a) its online webform at www.datarep.com/data-request; (b) email to datarequest@datarep.com, quoting "Renterprise, LLC / Uhura" in the subject line; or (c) post to DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland (EU/EEA) or DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom (UK). DataRep also maintains offices in each EU/EEA Member State; a full list of addresses is available at www.datarep.com. Letters must be marked for the attention of "DataRep."
• Data protection contact. We have not appointed a statutory Data Protection Officer. Our privacy team can be reached at support@uhura.ai.
• Legal bases. See Section 5. Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms, and you may obtain information about that assessment by contacting us.
• Your rights. You have the rights of access, rectification, erasure, restriction, data portability, and objection described in Section 12.3, and the right to withdraw consent at any time. You have an absolute right to object to processing for direct marketing. Where we process personal data on the basis of legitimate interests, you may object on grounds relating to your particular situation, and we will stop unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims.
• International transfers. We participate in the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework. See Section 9 for details, including how to raise a DPF-related complaint.
• Automated decision-making. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
• Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA Member State of your habitual residence, place of work, or place of the alleged infringement; in the UK, with the Information Commissioner's Office (ico.org.uk); and in Switzerland, with the Federal Data Protection and Information Commissioner. We would appreciate the opportunity to address your concerns first, so please contact us at support@uhura.ai.
• Requirement to provide data. Providing account information is necessary to enter into our Terms of Use; if you do not provide it, you cannot register. Providing other information is voluntary unless we tell you otherwise.

13.2 United States

State privacy laws. Residents of California, Colorado, Connecticut, Delaware, Florida (for covered businesses), Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws may have the rights described in Section 12.3, including the rights to access, correct, delete, and obtain a copy of personal information; to opt out of the sale of personal information, targeted advertising, and certain profiling; and to appeal a denied request, to the extent the relevant law applies to Renterprise. We do not sell personal information, engage in targeted advertising, or profile consumers in furtherance of decisions that produce legal or similarly significant effects. We process sensitive data only as necessary to provide the Service you request, and where a state requires consent for the processing of sensitive data, we obtain it. We honor opt-out preference signals, such as Global Privacy Control, where required. Rights requests, verification, timing, and appeals are described in Section 12.4.

California Consumer Privacy Act (CCPA/CPRA). If you are a California resident and the CCPA applies to Renterprise, the following additional disclosures apply.

Categories of personal information collected in the preceding 12 months, sources, purposes, and disclosures. The table below lists the categories of personal information enumerated in the CCPA that we collect, the sources, the business purposes, and the categories of third parties to which we disclose them for a business purpose. We do not sell or share any category.

Use of sensitive personal information. We use and disclose sensitive personal information only for the purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), namely to perform the services you request, to ensure security and integrity, to prevent fraud, and to comply with law. Because we do not use sensitive personal information to infer characteristics about you or for other purposes, the right to limit does not currently apply.

Your California rights. You have the right to know what personal information we collect, use, disclose, sell, or share; to delete personal information; to correct inaccurate personal information; to opt out of sale or sharing (we do not sell or share); to limit the use of sensitive personal information (not currently applicable); and to non-discrimination for exercising your rights. Exercise these rights as described in Section 12.4. We will acknowledge requests within 10 business days and respond within 45 days, extendable by another 45 days with notice.

Retention. See Section 10.

Financial incentives. Free Registration Credits are provided to all new users without regard to the exercise of privacy rights and are not a financial incentive for the provision of personal information. We do not offer financial incentives in exchange for personal information.

California "Shine the Light." California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

Minors. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Nevada. We do not sell covered information as defined under Nevada law. Nevada residents may nonetheless submit a request to opt out of any future sale by contacting support@uhura.ai.

Washington, Nevada, and Connecticut consumer health data. We do not collect, use, or share consumer health data as a purpose of the Service, and we do not use Communications Content to identify or infer health conditions. Health information that users incidentally include in their communications is processed solely to deliver and translate those communications.

Delaware. Renterprise is organized under the laws of Delaware. Delaware residents have the rights described above under the Delaware Personal Data Privacy Act to the extent it applies to us, and may appeal a denied request as described in Section 12.4; if the appeal is denied, you may contact the Delaware Department of Justice.

13.3 Canada

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Alberta's Personal Information Protection Act, and British Columbia's Personal Information Protection Act. Our Privacy Officer, who is responsible for our compliance with these laws and for responding to access and complaint requests, may be reached at support@uhura.ai. By using the Service, you acknowledge that your personal information will be transferred to and processed in the United States and other countries, where it may be accessible to the courts, law-enforcement, and national-security authorities of those countries. Quebec residents may request information about the personal information we hold about them, its use, and the parties to whom it has been disclosed, and have the rights described in Section 12.3, including the right to data portability where applicable. We do not use technology that identifies, locates, or profiles you without your knowledge. If you are not satisfied with our response to a complaint, you may contact the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner, including the Commission d'accès à l'information du Québec.

13.4 Brazil

If you are in Brazil, we process your personal data in accordance with the Lei Geral de Proteção de Dados Pessoais (LGPD). The legal bases described in Section 5 correspond to those under Article 7 of the LGPD, including performance of a contract, compliance with a legal obligation, legitimate interests, consent, and the regular exercise of rights in legal proceedings. You have the rights set out in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, and revocation of consent. Our data protection officer (encarregado) may be contacted at support@uhura.ai. International transfers are made in accordance with Chapter V of the LGPD. You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

13.5 Australia and New Zealand

If you are in Australia, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent they apply to us. Personal information is disclosed to overseas recipients, principally in the United States and the countries where our service providers and your recipients are located, and we take reasonable steps to ensure that overseas recipients handle it appropriately. You may access and correct your personal information and make a complaint as described in Section 12; if you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in New Zealand, we comply with the Privacy Act 2020 to the extent it applies, and you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

13.6 Japan

If you are in Japan, we handle personal information in accordance with the Act on the Protection of Personal Information (APPI). We obtain your consent to the provision of your personal data to third parties located outside Japan, including our service providers in the United States, as required by the APPI, and we provide information about the data-protection systems of those countries on request. Information about how we handle personal information, including the purposes of use, the categories of personal data we may provide to third parties, our security measures, and how to request disclosure, correction, suspension of use, or deletion, is set out in this Policy or available on request at support@uhura.ai.

13.7 Republic of Korea

If you are in the Republic of Korea, we process personal information in accordance with the Personal Information Protection Act (PIPA). Personal information is transferred overseas to the United States and to the countries where our service providers and your recipients are located, for the purposes of providing the Service, using the methods described in Section 9, and is retained for the periods described in Section 10; the recipients include the categories of service providers listed in Section 6.3. We destroy personal information without delay when the purpose of processing has been achieved or the retention period has expired, except where retention is required by law. Our privacy officer may be reached at support@uhura.ai. You may contact the Personal Information Protection Commission or the Korea Internet & Security Agency's Privacy Infringement Report Center with complaints.

13.8 Other Jurisdictions

Where you reside in another jurisdiction with data-protection legislation, including Singapore (Personal Data Protection Act 2012), India (Digital Personal Data Protection Act, 2023), South Africa (Protection of Personal Information Act), Nigeria (Nigeria Data Protection Act, 2023), Kenya, Mexico, Argentina, Colombia, Israel, Türkiye, the United Arab Emirates, Saudi Arabia, the Philippines, Indonesia, Thailand, and others, we process your personal information in accordance with that legislation to the extent it applies to us. You may have rights similar to those in Section 12.3, including rights of access, correction, deletion, portability, objection, withdrawal of consent, grievance redressal, and complaint to the relevant authority. Our grievance officer or privacy contact for all jurisdictions is support@uhura.ai. Where local law requires that we obtain your consent for cross-border transfers, your use of the Service with knowledge of this Policy constitutes that consent where permitted, and we will obtain separate express consent where required.

14. Children's Privacy

The Service is not directed to children under 13 years of age, or under the higher minimum age that applies in your jurisdiction (for example, 16 in several EU Member States), and we do not knowingly collect personal information from children below that age. If you are a parent or guardian and believe that your child has provided personal information to us without appropriate consent, please contact us at support@uhura.ai, and we will delete the information and terminate the account as required by applicable law, including the U.S. Children's Online Privacy Protection Act (COPPA). Where we knowingly offer features to users between the minimum age and 18, we apply additional protections, such as limiting data collection and not using their data for marketing, as required by applicable law.

15. Business Customers and Processor Activities

A business, nonprofit, governmental, educational, or other organization that uses the Service to communicate with its own customers, patients, clients, employees, or end users (a "Business Customer") is the controller of the personal information in those communications. In that context, we act as the Business Customer's processor (or service provider) and process the information only on its documented instructions, as set out in our Data Processing Addendum, which incorporates the Standard Contractual Clauses and other required terms and is available on request at support@uhura.ai. The Business Customer is responsible for providing privacy notices to its end users, obtaining any required consents (including for recording and for the processing of sensitive data), responding to end-user rights requests, and configuring the Service appropriately. If you communicate with a Business Customer through the Service and wish to exercise your rights regarding that Business Customer's data, please contact the Business Customer directly; we will assist the Business Customer as required by our agreement. Unless we have signed a business associate agreement, the Service is not intended for the transmission of protected health information regulated under HIPAA.

16. Third-Party Services, Links, and Platforms

The Service may link to or integrate with third-party websites, apps, and services, including app stores, sign-in providers, payment processors, and services that Business Customers connect to the Service. We are not responsible for the privacy practices of these third parties, and this Policy does not apply to them. We encourage you to read their privacy policies. The privacy practices of the app store through which you download the Apps, and of the operating system on your device, are governed by their own policies, which may give you additional controls (such as app-tracking transparency and permission settings).

17. Security Incidents and Breach Notification

We maintain an incident-response program to detect, investigate, contain, and remediate security incidents. If we become aware of a breach of security that affects your personal information, we will notify you and the relevant regulators without undue delay and within the timeframes required by applicable law, including the U.S. state breach-notification laws, the GDPR and UK GDPR (72 hours for notification to supervisory authorities where required), and equivalent laws elsewhere, and we will provide the information required by those laws. We may notify you by email, in-Service notification, or other means permitted by law.

18. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, our service providers, or applicable law. When we make changes, we will revise the "Last Updated" date at the top of this Policy. If the changes are material, we will provide additional notice, such as by email, by an in-Service notification, or by posting a prominent notice on the Website, before the changes take effect, and we will obtain your consent where applicable law requires it for a new purpose of processing. We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of an updated Policy means that you acknowledge the updated Policy, to the extent permitted by law.

19. How to Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, please contact us:

• Email: support@uhura.ai (please use the subject line "Privacy Request" for rights requests)
• Mail: Renterprise, LLC d/b/a Uhura, Attn: Privacy, 8 The Green #4000, Dover, DE 19901, United States
• Legal notices and service of process: Renterprise, LLC, 8 The Green STE A, Dover, DE 19901, United States
• EU/EEA representative (Article 27 GDPR): DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland; www.datarep.com/data-request; datarequest@datarep.com (quote "Renterprise, LLC / Uhura" in the subject line)
• UK representative (Article 27 UK GDPR): DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom; www.datarep.com/data-request; datarequest@datarep.com (quote "Renterprise, LLC / Uhura" in the subject line)
• Privacy team: support@uhura.ai
• This Policy: https://uhura.ai/privacy
• Terms of Use: https://uhura.ai/terms

We will respond to your inquiry as promptly as possible and within the time required by applicable law.

© 2026 Renterprise, LLC d/b/a Uhura. All rights reserved.