Effective date: 25 August 2026

Privacy Policy

INTRODUCTION

Sole proprietor Oleksii Bondarenko, with the address at Austria, Vienna, Heiligenstädter Str. 93/15 is registered in the Republic of Austria with the principal place of business Pawook AI (hereinafter also referred to as “Us”, “We”, or “Our”) acting as data controller cares about the confidentiality and security of personal data of individuals accessing or using the Service Pawook AI (hereinafter also referred to as the “Service”), which consists of content and accounts located within the pawook.ai, superbase.me web domains.

This Privacy Policy describes how we collect, use, and disclose your Personal Data when you interact with the Service.

This Privacy Policy is written in accordance with provisions of corresponding data protection legislation.

For users located in the European Economic Area (EEA) privacy rights are granted and all processing of Personal Information is performed in accordance with regulations and rules of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, known as the General Data Protection Regulation (“GDPR").

For users located in the US, all processing of Personal Data is performed in accordance with regulations and rules following the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) and other regulations specified in this Privacy Policy.

For users located in the United Kingdom, all processing of Personal Data is performed in accordance with regulations and rules following the UK’s implementation of the General Data Protection Regulation – the Data Protection Act 2018.

For users located in Ukraine, all processing of Personal Data is performed in accordance with the Law of Ukraine “On Personal Data Protection”.

This Privacy Policy is a notice and is not itself a request for Consent. Where Consent is the legal basis for Processing, We request it separately through Cookie settings or another clear affirmative choice. Optional analytics and marketing technologies remain disabled on the public Website until You enable them, and rejecting them does not prevent You from using the Website or requesting a demo.

DEFINITIONS

• “Personal Data” means information that relates to an individual who can be directly or indirectly identified.

• “Consent” means any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

• “Cookies” means small files or parts of files stored on your device, created and subsequently read by a Service server, containing personal information (such as an identification code, customized preferences, or a record of pages visited).

• “Data Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. For the purpose of this Privacy Policy, Sole proprietor Oleksii Bondarenko is a Data Controller of your Personal Data.

• “Data Processors” (or “Service providers”) means any natural or legal person who processes the Personal Data on behalf of the Data Controller.

• “Data subject” means an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person and is the subject of Personal Data.

• “Processing of Personal Data” (or “Processing”) means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

• “User” (or “You” or “Your”) is the individual using the Service and creating an account. The User corresponds to the Data Subject, who is the subject of Personal Data.

PERSONAL DATA WE COLLECT

We collect different types of information including your Personal Data for various purposes through the Service. We process certain Personal Data only insofar as this is necessary to provide a functioning Service for you.

When You create an account, We require Your email. When You request a demo on the public Website, the email field is validated in Your browser before the booking page opens. If You arrived through a referral and enabled Marketing technologies, the email You submit is sent to Tolt to record the demo request for referral attribution. Email addresses are not sent to Google Analytics.

When You continue to the scheduling page, the booking and calendar providers process the contact and meeting information You enter there. We process demo-request and booking information to respond to Your request and take steps at Your request before a possible contract. Any separate use for marketing or referral attribution is based on Your Consent.

When you pay for our services, we may also store payment information — typically your full name, payment method (and information provided to us by the payment provider), the payment amount, and the service (or services) you are paying for.

We may process content and files uploaded by Users, including images, videos, audio recordings, text materials, custom fonts and related metadata. Such content may contain Your Personal Data or Personal Data of third parties. We process this information to provide the service, store and display user content, enable sharing features, maintain security, prevent abuse, provide support, and comply with legal obligations. Users are responsible for ensuring that they have the necessary rights and permissions to upload content containing Personal Data of third parties

We also automatically collect information when you use our Service. For more information on our use of Cookies, please refer to Section “COOKIES” of this Privacy Policy.

HOW WE USE YOUR PERSONAL DATA

We use information, including Personal Data, to carry out the following purposes:

Account initialization and access management – to enable You to use the Service by creating and maintaining an account.

Operate and improve the Service — to create and improve existing features, and develop new ones that enable Service usage.

Communicate with you — to answer your questions and notify you of the Service maintenance and updates. We do this on the basis of our legitimate interests in keeping Users up to date about the Service and responding to questions.

Measure the public Website — With Your Consent, We use Google Analytics 4 to understand visits, navigation and demo-funnel steps so that We can improve the Website and evaluate acquisition channels. Google Analytics does not receive the email entered in the demo form.

Understand and improve the authenticated Service — We use PostHog for product analytics as described in this Policy and any applicable in-product privacy controls. We limit this Processing to what is needed to understand feature use, performance and reliability and rely on Consent where applicable law requires it for optional storage or tracking.

Arrange a demo — We process the information You provide to respond to Your demo request, enable scheduling and communicate about the requested meeting. This Processing is necessary to take steps at Your request before a possible contract and is also in Our legitimate interest in responding to business enquiries.

Ensure security – to prevent fraud, monitor account security, protect Personal Data from unauthorized access, and take steps to secure Our Service.

Exercise, enforce, and comply with legal rights and obligations — Under certain circumstances, We use information we collect for this purpose to respond to valid requests by public authorities, court orders, or other legal process; and to investigate, prevent, or take action regarding illegal activities, suspected fraud, security or technical issues, or to protect the rights, property, or safety, and as otherwise required by applicable law. We do this to comply with applicable law (including laws requiring us to keep Personal Data secure), or to meet Our legitimate interests in preventing illegal activity, and/or protecting our rights and those of others.

Marketing and advertising purposes (upon your Consent) – to send You personalized offers, promotional messages, and promotions that may be of interest to You.

DATA SUBJECT RIGHTS

Users should have clear and meaningful control over Personal Data. Depending on where You live and which privacy laws apply to You (such as the GDPR in the European Union or other local regulations), You may have a number of rights regarding the Personal Data We collect and Process, including as follows:

• Right of access: to request what Personal Data We collect about You and to receive a copy of that Personal Data.

• Right to rectification: to request that Your incomplete or inaccurate Personal Data is corrected or updated.

• Right to erasure (right to be forgotten): to ask Us to delete Your Personal Data in certain circumstances, for example if it is no longer necessary for the purposes for which it was collected.

• Right to restriction of Processing: to request that We restrict the Processing of Your Personal Data in cases where You contest the accuracy of the Personal Data or the Processing, and We will stop Processing it pending verification. After verification, if Your concerns are confirmed, We will correct or delete the Personal Data if necessary.

• Right to data portability: to receive Your Personal Data in a structured, machine-readable format and transfer it to another Data Controller.

• Right to object to Processing: to object to the Processing of Your Personal Data if We Process it based on legitimate interests or for marketing purposes.

• Right not to be subject to an automated individual decision: not to be the subject of a decision taken solely on the basis of automated Processing activities, including the creation of profiles, which produce legal effects concerning the Data Subject or similarly affect him / her in a significant measure.

• Right to withdraw Consent: to withdraw Your Consent at any time.

• Right to file a complaint: to file a complaint to the regulatory body of the National Supervisory Authority for the Processing of Personal Data or competent courts, in case Your request was not satisfied, to the extent You deem necessary.

PERSONAL DATA TRANSFER

We may transfer Your Personal Data to Third Parties in the following situations, always ensuring that such transfers are made in accordance with applicable data protection laws and based on appropriate safeguards such as contractual obligations, technical measures, and legal mechanisms, to the following types of recipients:

Service providers, contractors, and other third parties – Service providers, contractors, and other third parties that provide business, professional, or technical support functions for Us receive Your Personal Data. These parties are given access only to the extent needed for the relevant service. They include Stripe for payment processing; Supabase, Google Cloud and AWS for infrastructure; PostHog for product analytics; Notion Calendar and the connected calendar provider for demo scheduling; Google Ireland Limited for consented public-Website analytics; Tolt for consented referral attribution; and Meta and LinkedIn for consented campaign measurement. Optional analytics and marketing providers receive data only when the corresponding choice is enabled.

For legal or safety reasons — Under certain circumstances, We may be required to disclose your Personal Data if required to do so by law, regulation, legal process, in connection with an investigation on matters related to public safety or in response to valid requests by public authorities. We disclose your Personal Data to protect the security of the Service and Our servers, network systems, and databases.

We may also seek Your consent for additional disclosures of information, including Personal Data, and will share it only as described to You or as described in this Privacy Policy.

We may transfer Personal Data from your location to other countries, including those outside the European Economic Area (EEA), where our employees, service providers and/or servers are located.

When we transfer Personal Data outside the EEA, We ensure that appropriate measures are in place to protect Personal Data in accordance with the requirements of Data protection laws, including:

• For users in the EU, We comply with the requirements of the GDPR.

• For users in California, USA, We comply with the requirements of the CCPA.

• For users in Ukraine, We comply with the requirements of the Law of Ukraine “On Personal Data Protection”.

• For users in other countries where Data protection laws exist, We comply with the relevant local requirements.

We use Standard Contractual Clauses or other legal mechanisms to ensure an adequate level of protection for Personal Data when it is transferred outside the specified jurisdictions.

HOW TO MANAGE YOUR PERSONAL DATA

We aim to take reasonable steps to allow You to correct, amend, delete, or limit the use of your Personal Data. You can manage your Personal Data in Your account or submit requests to the support team via email support@pawook.ai. We will provide support to the extent required by applicable law and more broadly when possible. We will notify You in the event we are unable to meet a request that is not legally required.

Access and correct your Personal Information

Your email and password are editable through your account settings.

Delete account and Personal Information

To request deletion of your account and Personal Data, you should submit requests to the support team via email support@pawook.ai. Please note that deletion of Your account and Personal Data is a permanent action that cannot be reversed. We will not be able to recover Your account or the deleted data.

Once your account is deleted, you can not use Service.

With respect to your account, we will permanently: deactivate Your account, remove the active profile.

With respect to your Personal Data, we will permanently remove Your account profile Personal Data from the Service.

RETENTION & SECURITY

We will retain your Personal Data only as long as it is necessary for the purposes set out in this Privacy Policy. We will retain your Personal Data for as long as Your account is active or as needed to provide You services. We will also retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your Personal Data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. We will also retain Information for internal analysis purposes.

The public Website stores Your Cookie preferences locally for up to 180 days. Google Analytics user-level event data is retained for no longer than 14 months. Demo and booking information is retained for as long as needed to handle the request, maintain appropriate business records and comply with legal obligations. Provider-specific retention may be shorter where configured or required.

We store information, including Personal Data, on our own servers and on servers of companies that We hire to provide services. The place of Personal Data storage is Supabase, eu-west-1 Ireland and Google Cloud and AWS in the European Region.

The security of your personal data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

We follow generally accepted industry standards to protect the information submitted to us, both during transmission and once we receive it. We maintain technical, physical, and administrative security measures to provide reasonable protection for your personal information. When our contractors or we process your information, we also make sure that your information is protected from unauthorized access, loss, manipulation, falsification, destruction or unauthorized disclosure. This is done through appropriate administrative, technical and physical measures.

COOKIES AND SIMILAR TECHNOLOGIES

Cookies and similar technologies, including local storage and pixels, may store or read information on Your device. Optional technologies on the public Website remain disabled until You make an affirmative choice in Cookie settings.

• Necessary storage. We use local storage under pawook_cookie_consent_v1 to remember Your privacy choices for up to 180 days. This is required to apply Your choices consistently and cannot be disabled through the banner.

• Public-Website analytics. With Your Analytics Consent, Google Analytics 4 measures page views, referrers, campaign information, device and browser characteristics, approximate location and interactions such as the Book a demo click and successful demo-form submission. Google Analytics may set first-party cookies beginning with _ga, generally for up to two years. We disable Google Signals and advertising-personalisation signals in Our Website configuration. We do not include email addresses in Analytics events, URLs or campaign parameters.

• Product analytics. Where enabled in the authenticated Service, PostHog helps Us understand feature usage, navigation and performance. Its first-party cookie may begin with ph_phc_. Applicable in-product controls and Consent requirements continue to apply separately from the public Website.

• Marketing and campaign measurement. With Your Marketing Consent, LinkedIn Insight and Meta Pixel may process page, referrer, device, browser and online-identifier information to measure campaigns. Tolt may store a referral identifier and, when You submit the demo form after arriving through a referral, receive the submitted email to associate the request with the referring partner.

You may reject all optional technologies, choose Analytics and Marketing separately, or withdraw a previous choice at any time through Cookie settings in the Website footer. Withdrawal does not affect the lawfulness of Processing that occurred before withdrawal.

ADDITIONAL INFORMATION FOR RESIDENTS OF THE UNITED STATES OF AMERICA

This section applies only if You are a resident of certain U.S. states that have implemented state-level privacy laws. You, as a Subject of Personal Data, have some special privacy rights. To use them, please contact Us.

*Please note! Depending on the state and legislative requirements, We have from 30 (thirty) to 60 (sixty) days to exercise Your request, with the right to postpone it for 30 (thirty) days more.*

If Your complaint is not satisfied, You can file a complaint with the Federal Trade Commission.

Also, You may submit a complaint as follows:

• For Colorado residents, to the Colorado AG at: https://coag.gov/file-complaint/

• For Connecticut residents, to the Connecticut AG at: https://www.dir.ct.gov/ag/complaint/

• For Montana residents: https://dojmt.gov/consumer/

• For Oregon residents: https://justice.oregon.gov/consumercomplaints/

• For Texas residents: https://oag.my.salesforce-sites.com/CPDOnlineForm

• For Utah residents: https://attorneygeneral.utah.gov/contact/complaint-form/

• For Virginia residents, to the Virginia Attorney General at: https://www.oag.state.va.us/consumercomplaintform

• For residents of Florida at: https://www.myfloridalegal.com/consumer-protection/consumer-complaint-form

Your rights vary depending on the laws that apply to You, but may include:

Access to specific Data and the right to transfer Data

With certain exceptions, if You are a resident of the state of California, USA, You have the right to request a copy of the Personal Data (defined as Personal information for the purposes of this section) We have collected about You in the 12 (twelve) months prior to Your request. After receiving Your request and establishing Your identity, We will inform You of:

– categories of Personal information that We have collected about You,

– Our business or commercial purpose for collecting such Personal information,

– categories of Third Parties with whom We share this Personal information.

Also, if You are an Oregon resident, Delaware, Minnesota (effective from 31/07/2025), Maryland (effective from 01/10/2025) You also have the right to receive a list of the specific Third Parties to which We have disclosed Personal Data in Our capacity as a Controller, provided that We are not required to disclose its trade secrets.

To exercise Your rights, You may submit the request by sending an email. We will ensure that Your request is processed in accordance with the relevant legal requirements. We may require specific information from You to help Us confirm Your identity and process Your request. You have the right not to be discriminated against for exercising any of Your rights.

Non-discrimination

We will not discriminate against You for exercising Your rights related to the Processing of Your Personal information, as well as Your right to refuse to receive Our Features in the future, or for refusing to receive further marketing, informational / advertising materials from Us.

Sales and sharing of Personal information

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to opt out of the “sale” or “sharing” of their Personal information. “Sale” refers to the disclosure of Personal information to a Third Party for monetary or other valuable consideration. “Sharing” refers to the disclosure of personal information for cross-context behavioral advertising.

We do not sell Personal information for money. If You enable Marketing technologies, Meta, LinkedIn and Tolt may receive the online identifiers, campaign information and referral data described above. Certain U.S. laws may define some campaign-measurement disclosures as “sharing” for cross-context behavioural advertising even where no money is exchanged.

You can opt out by selecting Reject optional, disabling Marketing in Cookie settings, or contacting Us. The public Website and demo-booking flow remain available after You opt out.

We do not collect sensitive Personal information as defined under the CCPA.

COPPA (Children Online Privacy Protection Act)

When it comes to the collection of Personal information from children under 13, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation’s consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online.

Fair Information Practices

The Fair Information Practices Principles form the backbone of privacy law in the United States, and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect Personal Data.

In order to be in line with Fair Information Practices We will take the following responsive action, should a data breach occur:

- We will notify the Users via Platform notification within 7 (seven) business days.

We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data Collectors and Processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and / or prosecute non-compliance by Data Processors.

ADDITIONAL INFORMATION FOR RESIDENTS OF UKRAINE

This section applies only to residents of Ukraine and is based on the Law of Ukraine “On Personal Data Protection” No. 2297-VI dated 01.06.2010.

Each User’s personal non-property rights in relation to Personal Data are inalienable and inviolable.

As a resident of Ukraine, You have the right to:

• be informed about the sources, location, and purpose of the Processing of Your Personal Data;

• access Your Personal Data and receive a copy within 30 (thirty) calendar days after request;

• request correction or deletion of inaccurate or unlawfully processed Data;

• object to the Processing of Your Data in justified cases;

• withdraw Your Consent to Processing at any time;

• restrict or condition Your Consent when granting it;

• be protected from automated decisions that significantly affect You;

• file complaints to the Ukrainian Parliament Commissioner for Human Rights (ombudsman) or the court in case of violation of Data protection legislation.

To exercise any of these rights, please contact Us.

We will review Your request within 10 (ten) business days and respond within 30 (thirty) calendar days, unless otherwise required by law.

If the Processing of Personal Data poses a particular risk to Your rights and freedoms, the Controller will notify the Ukrainian Parliament Commissioner for Human Rights within 30 (thirty) business days of initiating such Processing.

CHANGES TO PRIVACY POLICY

We may review and update this Privacy Policy from time to time. We will notify You of changes by posting the updated Policy on this page and changing the “Effective date” above. If a change introduces a new purpose that requires Consent, We will request that Consent separately; continued use alone is not treated as Consent to new optional Processing. You are advised to review this page periodically.

CONTACT INFORMATION

If you have any questions about this Privacy Policy or have privacy concerns, would like to access, delete or correct Personal Data, please contact our support team:

By email: support@pawook.ai