Structum Privacy Notice

Effective Date: October 1, 2026

Last Updated: October 1, 2026

This Privacy Notice (“Notice”) explains how the Structum Operating Entity (defined below) (“Structum,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects Personal Information in connection with the Structum AI™ platform available at structumai.build, our public website, hosted software, application programming interfaces, Model Context Protocol (“MCP”) server, AI-assisted functionality, integrations, demonstrations, support, events, and related services (collectively, the “Services”).

“Structum Operating Entity” means Structum AI LLC, a Delaware limited liability company with its principal office at 8 The Green, Suite B, Dover, DE 19901, United States, together with any successor entity that continues its business, including by statutory conversion into a corporation (in which case the entity is expected to be named Structum AI, Inc.). A change in the Structum Operating Entity’s legal form or name does not change the practices described in this Notice or your rights under it; the current legal name is stated in Section 28.

The Structum Operating Entity operates the Services under license from its Affiliate Structum AI IP L.L.C., a Wyoming limited liability company, which owns the Structum AI platform, software, and trademarks. Structum AI IP L.L.C. is not a party to your relationship with us and does not independently determine how Personal Information in the Services is used. Section 11 and Section 17 describe the limited circumstances in which affiliate personnel or contractors may access Personal Information.

Important role distinction. For most project records, uploaded documents, connected email, workforce information, and other content submitted by or for a business customer, Structum processes the data on the Customer’s behalf. The Customer—not Structum—generally decides why that data is processed, who may access it, how long it is retained, and how individual requests are handled.

1. Who We Are and Scope of This Notice

This Notice applies when Structum determines the purposes and means of processing Personal Information, such as when you visit our public website at structumai.build, request a demo, create or administer an account, communicate with us (including by email to an @structumai.io address), receive marketing, attend an event, use a feature for which Structum acts as the responsible business or controller, or interact with our support, security, billing, or business teams. Our public web presence is limited to structumai.build and our social-media channels; structumai.io is used only for email and does not host a website.

This Notice also describes, at a high level, how Structum handles Customer Content as a processor, service provider, or contractor for Customers. The Customer’s privacy notice, contract, project requirements, collective bargaining obligations, employee notice, subcontractor notice, or other disclosure may provide additional or controlling information for that Customer Content.

This Notice does not apply to: (a) third-party websites, products, or services that have their own privacy notices; (b) Personal Information Structum processes solely in its capacity as an employer, prospective employer, or contracting party under a separate workforce or applicant notice; (c) information that is lawfully deidentified or aggregated so it is not Personal Information under applicable law; or (d) processing governed by a separate written notice that expressly states it supersedes this Notice for a specific feature or context.

The Services are primarily business-to-business tools designed for construction owners, contractors, subcontractors, consultants, project teams, and other organizations. References to “you” may mean an individual user, a website visitor, a prospect, a recipient of a communication, or a person whose information appears in Customer Content, depending on context.

2. Structum’s Role and the Customer’s Role

2.1 Customer Content

“Customer Content” means data, documents, communications, records, images, files, prompts, instructions, and other content submitted to, imported into, synchronized with, generated within, or otherwise processed through the Services by or for a Customer. Customer Content may include Personal Information relating to Customer personnel, subcontractors, vendors, project owners, design professionals, consultants, occupants, applicants, visitors, inspectors, and other third parties.

For Customer Content, Structum generally acts as a “processor,” “service provider,” or “contractor,” and the Customer acts as the “controller” or “business,” using the terminology of applicable privacy law. Structum processes Customer Content according to the Customer’s documented instructions, the applicable Order Form, Terms of Service, Data Processing Addendum (“DPA”), feature configuration, user action, and law. Structum does not independently determine the Customer’s lawful basis for collecting Customer Content or the Customer’s construction, employment, public-record, safety, record-retention, or notice obligations.

Customers are responsible for: (a) having authority to provide Customer Content to Structum; (b) giving required notices and obtaining required permissions or consents; (c) configuring access, retention, integrations, and AI features appropriately; (d) responding to requests relating to Customer Content; (e) ensuring that use of the Services complies with employment, labor, monitoring, communications, public-record, biometric, location, safety, and sector-specific laws; and (f) avoiding submission of data that the Services are not contractually authorized to process.

2.2 Structum-Controlled Processing

Structum acts as a controller or business for Personal Information used for its own account administration, billing, security, fraud prevention, support operations, website analytics, business communications, marketing, product planning, legal compliance, corporate transactions, and other purposes described in this Notice, unless a written agreement states otherwise.

2.3 Requests Concerning Customer Content

If your Personal Information was submitted by a Customer—for example, your employer, general contractor, subcontractor, project owner, or other organization—direct your request to that Customer. Structum may refer your request to the Customer and will provide reasonable assistance required by the applicable agreement and law. Structum may be unable to fulfill a request directly when doing so would conflict with the Customer’s instructions, disclose another person’s information, impair security, or exceed Structum’s legal role.

3. Definitions

“Authorized User” means a person permitted by a Customer to access the Services, including administrators, employees, contractors, consultants, invited collaborators, and external project participants.

“Customer” means the organization or person that orders, subscribes to, administers, or otherwise controls an account or project environment in the Services.

“Personal Information” or “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an identified or identifiable person or household, and includes equivalent terms under applicable law. It does not include information excluded by law, such as certain public, aggregate, or deidentified information.

“Sensitive Personal Information” means Personal Information subject to heightened protection under applicable law, which may include account credentials, government identifiers, precise geolocation, financial credentials, contents of communications, health or safety information, biometric identifiers, racial or ethnic origin, religious beliefs, citizenship or immigration status, union membership, genetic data, and similar data.

“AI Feature” means functionality that uses machine learning, large language models, generative AI, optical character recognition, natural-language processing, computer vision, statistical models, or other automated techniques to extract, classify, search, summarize, draft, recommend, prioritize, identify patterns, or otherwise assist a user.

“AI Client” means a third-party AI assistant, agent, or application that a Customer or Authorized User chooses to connect to the Services through our MCP server or API—for example, an AI assistant offered by an independent AI company—so that the AI Client can read or act on the Customer’s data in the Services on the user’s behalf. The provider of an AI Client is not Structum’s subprocessor or service provider; it is an independent third party selected by the Customer.

“Affiliate” means an entity that controls, is controlled by, or is under common control with the Structum Operating Entity. As of the Last Updated date, Structum’s Affiliates are Structum AI IP L.L.C. (the owner and licensor of the Structum AI platform and marks) and Castellum Capitalium LLC (the manager and sole member of both Structum entities). Companies whose products or APIs Structum uses—such as cloud-hosting, AI-model, email, calendar, accounting, payment, or communications providers—are not Affiliates; depending on their role they are service providers, subprocessors, integration providers, or independent third parties, as described in Section 11.

4. Summary of Core Practices

5. Personal Information We Collect

The categories below describe information Structum may collect. The actual categories depend on the Services, Customer configuration, role, device, integrations, and features you use. Structum seeks to collect information that is reasonably necessary and proportionate for the disclosed purposes.

5.1 Account, Identity, and Authentication Information

• Name, business email address, telephone number, username, avatar, signature, preferred language, time zone, notification settings, and other profile information.

• Organization name, office, project role, job title, trade, department, license or credential information, supervisor, and account permissions.

• Password hashes, authentication tokens, single sign-on identifiers, multi-factor authentication details, recovery information, OAuth grants, and security verification data.

• Invitations, account status, consent records, acceptance of terms, administrator assignments, and relationship to a Customer or project.

5.2 Construction, Project, and Business Content

Customer Content may include project names and addresses; owner, contractor, subcontractor, supplier, consultant, and occupant information; plans, drawings, specifications, building information modeling files, schedules, budgets, estimates, takeoffs, bids, proposals, requests for proposal, requests for information, submittals, transmittals, change orders, purchase orders, payment applications, invoices, lien waivers, insurance certificates, warranties, permits, inspection records, closeout records, daily logs, punch lists, quality records, safety records, meeting minutes, photos, videos, and other construction or property records.

Customer Content may also contain business contact information, signatures, employment-related information, payroll or time records, union or immigration-related information, government identifiers, financial details, incident or injury information, location data, confidential business information, and other Sensitive Personal Information. Structum does not require every category and often receives it only because a Customer chooses to upload, connect, generate, or retain it.

5.3 Communications and Collaboration Information

• Emails, messages, chats, comments, mentions, notifications, attachments, distribution lists, recipients, timestamps, delivery status, drafts, signatures, and message metadata.

• Meeting invitations, calendar events, agendas, participants, transcripts, recordings, notes, action items, and follow-up communications.

• Support tickets, help-desk conversations, implementation records, feedback, survey responses, product suggestions, and diagnostic attachments.

• Communications sent through connected mailboxes or on behalf of a user when the user or Customer instructs the Services to draft, route, classify, or send them—including bid invitations, bid follow-ups, and other procurement correspondence that the Services send to vendors and subcontractors at a Customer’s direction. Those messages identify the Customer as the party on whose behalf they are sent and are transmitted through Structum’s email infrastructure.

• Telephone numbers and text-message (SMS) content, delivery status, and opt-in and opt-out records, if a user or Customer elects to receive or send text messages through the Services. See Section 5.12.

Meeting recordings and transcripts. The Services do not themselves record audio or video of meetings or calls. Meeting transcripts, minutes, summaries, and action items in the Services are generated from recordings, transcripts, or notes that a Customer or Authorized User uploads, connects, or enters. The Customer is responsible for determining whether a recording was lawfully made and for obtaining any notice or consent required by the law of the place where the participants were located, which in some jurisdictions (including Florida) requires the consent of all parties to a private conversation.

5.4 Connected Accounts and Integration Data

When a user or Customer connects a third-party service, Structum may receive account identifiers, authorization tokens, tenant or domain identifiers, user and administrator information, and the data permitted by the scopes and permissions approved during authorization. Depending on the integration, this may include email, calendar, contacts, files, folders, shared drives, project systems, customer relationship management records, accounting or enterprise resource planning data, cloud storage, identity data, and metadata.

5.5 Billing, Subscription, and Transaction Information

We may collect billing contacts, billing addresses, tax information, subscription level, seat counts, order forms, invoices, payment status, transaction history, credit or refund records, and limited payment-card metadata. Payment-card numbers are collected and processed by Paddle, the merchant of record through which Structum sells paid subscriptions (see Section 11), and are not stored by Structum.

5.6 Device, Usage, Log, and Security Information

• IP address, browser type, operating system, device type, device or advertising identifiers, language, time zone, and approximate location inferred from IP address.

• Dates and times of access; pages, screens, links, and features used; session duration; referring and exit pages; search terms; workflow events; API requests; import, export, download, and sharing events.

• Authentication events, permission changes, administrator actions, audit records, security alerts, abuse signals, rate limits, error logs, crash reports, performance data, and diagnostic information.

• Cookie identifiers, consent settings, campaign information, referral source, and interactions with marketing or analytics communications.

5.7 Location Information

Structum may infer an approximate location from an IP address. Precise device or project location is collected only when a Customer enables a location-aware feature, a user grants device permission, location metadata is included in an upload, or a connected service provides it. Location can support site workflows, fraud prevention, localization, routing, time records, or other Customer-requested functions.

5.8 AI Inputs, Context, Outputs, and Evaluation Data

When an AI Feature is used, Structum may process prompts, instructions, uploaded files, retrieved project context, message content, document text, images, structured records, metadata, embeddings or vector representations, generated outputs, citations, classifications, user edits, ratings, corrections, safety flags, feature settings, and technical telemetry. These records may be Customer Content or Structum-controlled data depending on the context and agreement.

When a Customer connects an AI Client to the Services (see Section 9.8), Structum also receives and logs the identity of the connected AI Client, the authorization granted to it, the tool or API calls it makes, the parameters of those calls, the records returned, any write actions proposed or confirmed, and related timestamps and technical metadata. Structum does not receive the user’s full conversation with the AI Client—only the requests the AI Client sends to the Services.

5.9 Support, Demonstrations, Events, and Business Communications

We may collect information you provide when requesting a demonstration, contacting sales, attending an event, participating in onboarding, receiving training, reporting a security issue, or communicating with Structum personnel. With notice or consent where required, Structum may record or transcribe support, training, implementation, or sales calls for the disclosed purpose.

5.10 Information About Other People

Users may provide information about coworkers, subcontractors, vendors, project participants, recipients, or other people. The person providing the information represents that they have authority to do so and are responsible for providing any legally required notice. Structum may use the information to send an invitation, route a communication, populate a project record, provide the requested workflow, maintain security, or comply with Customer instructions.

5.11 Sensitive Personal Information

Structum may process Sensitive Personal Information when needed for account security, a Customer-selected workflow, a connected email or file feature, a construction safety or workforce record, legal compliance, or another disclosed purpose. Structum does not use Sensitive Personal Information to infer characteristics for unrelated advertising and does not sell Sensitive Personal Information. Where consent or a separate notice is required, Structum or the Customer will obtain it according to their respective legal roles.

Structum does not intentionally derive biometric identifiers or biometric templates from ordinary project photos, videos, voice recordings, or meeting media unless a separately disclosed and contractually authorized biometric feature is offered. Incidental images or voices in Customer Content are not treated as biometric identifiers unless used or intended to be used to establish identity.

5.12 Text Messages (SMS)

If the Services offer text-message notifications or communications, Structum sends text messages only to telephone numbers whose users have opted in through the Services, an account setting, a Customer’s configuration for its own Authorized Users, or another disclosed opt-in method. Messages may include account security codes, project notifications, reminders, and communications a Customer directs the Services to send. Message frequency varies by use. Message and data rates may apply. You may opt out at any time by replying STOP to a message, by changing your notification settings, or by contacting support@structumai.io; reply HELP for assistance.

Structum uses third-party telecommunications and messaging providers to transmit text messages, and those providers process telephone numbers and message content to deliver the messages. Mobile telephone numbers, SMS consent, and opt-in information collected for text messaging will not be shared with or sold to third parties or Affiliates for their marketing or promotional purposes, and will not be transferred to lead generators. Customers that use the Services to send text messages to their own personnel, vendors, or other recipients are responsible for obtaining any consent required for those messages.

6. Sources of Personal Information

• Directly from you, including through forms, account creation, uploads, communications, support, demonstrations, events, surveys, and feature use.

• From a Customer, administrator, employer, project owner, contractor, subcontractor, consultant, or other Authorized User who creates an account, invites you, assigns permissions, imports records, or submits Customer Content.

• From connected accounts, integrations, identity providers, APIs, cloud storage, project systems, email and calendar providers, payment processors, and enterprise systems at the direction of a user or Customer.

• From AI Clients that a Customer or Authorized User connects to the Services, in the form of the requests, queries, and proposed actions the AI Client sends to our MCP server or API on the user’s behalf.

• Automatically from devices, browsers, cookies, SDKs, servers, logs, security tools, analytics tools, and interactions with the Services or our communications.

• From service providers and business partners, such as resellers, implementation partners, event sponsors, referral sources, customer-success systems, and fraud or security providers.

• From public and professional sources, including company websites, business directories, licensing records, public project records, and professional networking sources, where permitted.

• From information Structum derives, infers, classifies, or generates from other data, including security signals, usage analytics, document classifications, and AI-assisted outputs.

7. How We Use Personal Information

Structum may use Personal Information for the purposes below, subject to the Customer’s instructions and applicable law. A particular record may be used for more than one compatible purpose.

• Provide, host, operate, configure, maintain, and administer the Services and Customer environments.

• Create and manage accounts, organizations, permissions, roles, projects, subscriptions, authentication, and single sign-on.

• Store, index, search, display, organize, route, synchronize, transmit, export, and otherwise process Customer Content as instructed.

• Enable collaboration, invitations, notifications, messaging, email, calendar, file, workflow, reporting, audit, and integration functions.

• Provide AI Features, including extraction, optical character recognition, classification, summarization, drafting, search, recommendation, prioritization, pattern identification, and workflow assistance.

• Operate the API and MCP server; authenticate and authorize AI Clients and other API callers; return requested data to them; prepare, preview, and (after confirmation by an Authorized User) execute actions they propose; and log that activity for security, audit, and Customer visibility.

• Send text messages, emails, and other communications that a user or Customer directs the Services to send, including vendor and subcontractor procurement correspondence sent on the Customer’s behalf.

• Process orders, invoices, payments, credits, taxes, renewals, usage limits, and account collections.

• Provide onboarding, implementation, training, Customer success, technical support, troubleshooting, and requested professional services.

• Authenticate users, enforce access controls, maintain tenant separation, monitor activity, prevent fraud and abuse, detect incidents, protect safety, investigate misuse, and secure the Services.

• Debug, test, maintain availability, measure performance, conduct quality assurance, manage capacity, and improve reliability and usability.

• Analyze feature adoption, service usage, business trends, and Customer needs; develop new functionality; and create deidentified or aggregate analytics, benchmarks, and research.

• Communicate about the Services, changes, incidents, renewals, security, support, events, products, and offers, subject to communication preferences and law.

• Comply with law, regulations, court orders, subpoenas, lawful requests, sanctions requirements, tax and accounting duties, public-record obligations applicable to a Customer, and contractual commitments.

• Establish, exercise, or defend legal claims; enforce agreements; conduct audits and investigations; protect Structum, Customers, users, and others; and preserve evidence.

• Evaluate or complete a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or other corporate transaction.

• Carry out any other purpose disclosed at collection, authorized by the Customer, requested by you, or permitted by law.

Structum may combine information collected through different parts of the Services when the combination is compatible with the disclosed purposes and permitted by the applicable Customer agreement and law.

8. Legal Bases for Processing

This section is primarily relevant where laws such as the EU GDPR, UK GDPR, or similar frameworks require a legal basis. Structum’s legal basis depends on the context. For Customer Content processed on behalf of a Customer, the Customer determines the legal basis and Structum processes under the Customer’s instructions.

Where Structum relies on legitimate interests, it considers the purpose, necessity, reasonable expectations, sensitivity, potential impact, and safeguards. You may contact privacy@structumai.io for additional information about a specific balancing assessment where required by law.

9. AI-Assisted Features and Automated Processing

9.1 What AI Features Do

AI Features may extract text or fields, classify documents, summarize communications, identify missing or inconsistent information, search project records, organize workflows, suggest responses, draft documents, prioritize tasks, detect patterns, or provide recommendations. The feature description, user interface, Customer configuration, and any AI Transparency Notice provide additional context about a particular feature.

9.2 Information Used by AI Features

An AI Feature may process the user’s prompt, selected files, Customer Content, connected-account data, retrieved project context, prior messages, feature settings, and technical metadata needed to generate an output. Structum seeks to transmit only the information reasonably necessary for the requested feature. Customers control which data sources, users, projects, and integrations are made available to the feature, subject to plan and configuration.

9.3 AI Providers and Subprocessors

Structum may use third-party model, hosting, search, transcription, document-processing, or AI infrastructure providers (for example, large-language-model providers and cloud AI services) to deliver AI Features. These providers process data to deliver the selected feature under contractual and technical restrictions appropriate to their role, including, where available, provider terms under which the provider does not use Structum’s inputs or outputs to train its generalized models. The current list of material subprocessors, including AI providers, is available on request from privacy@structumai.io and, for Customers, through the DPA and its notice procedures. Data may be routed among providers based on availability, security, feature, region, Customer contract, model capability, and service configuration.

9.4 Model Training and Service Improvement

Unless an applicable Customer agreement, feature-specific notice, or affirmative opt-in expressly states otherwise, Structum does not use Customer Content—including connected email, project documents, prompts, or AI outputs—to train or fine-tune generalized AI models made available to other customers or the public. Structum may use Customer Content within the Customer’s environment to create indexes, embeddings, retrieval systems, configurations, or Customer-specific functionality requested by the Customer.

Structum may use deidentified or aggregate usage telemetry, error information, performance measurements, safety signals, and feedback to improve security, reliability, usability, and AI quality, provided the information is maintained in deidentified or aggregate form where required. Structum may also use content when a user or Customer expressly submits it for evaluation, support, quality review, or product feedback and the use is permitted by the applicable agreement and law.

9.5 Human Access and Review

Authorized Structum personnel may access limited AI-related content only when reasonably necessary to provide support requested by the Customer or user, investigate a security or abuse issue, comply with law, enforce agreements, evaluate a reported defect, or conduct a quality review permitted by the applicable agreement, consent, and law. Access is subject to role-based controls and confidentiality obligations. AI providers may have limited human-access exceptions under their contracts for security, abuse, support, or legal compliance.

9.6 Human Decision-Making and Significant Effects

AI outputs are assistive and may be incomplete, inaccurate, or inappropriate for a particular project or decision. Structum does not use AI Features, in its own controller capacity, to make solely automated decisions that produce legal or similarly significant effects concerning an individual. Customers and users are responsible for reviewing outputs before relying on them and for providing any required notice, consent, explanation, impact assessment, appeal, or human intervention if they use outputs in a decision affecting a person.

The Services are not a consumer reporting agency, and AI outputs are not intended to be consumer reports or to determine a person’s eligibility for credit, insurance, housing, employment, or another legally regulated benefit. Customers must not use the Services for such purposes unless Structum expressly authorizes the use in writing and all applicable legal requirements are satisfied.

9.7 Rights Related to Automated Processing

Where applicable law grants a right to access information about, obtain meaningful information concerning, request human review of, or opt out of certain automated decision-making or profiling, Structum will honor the right for processing for which Structum is the responsible controller and will assist Customers as required for Customer-controlled processing. Security, fraud-prevention, legal-compliance, and service-protection processing may be exempt or subject to limitations under law.

9.8 AI Clients, the MCP Server, and API Access

In addition to the AI Features built into the Services, a Customer may connect an AI Client of its choosing to the Services through Structum’s MCP server or API. When a Customer or Authorized User does so:

• The AI Client acts on the user’s instructions. The AI Client sends requests to the Services (for example, to search project documents, retrieve an estimate, list open submittals, or prepare a purchase order), and the Services return the requested data or a preview of the proposed action, subject to the permissions the Customer has granted to that connection. Permissions are granted on a per-module basis.

• The AI Client provider is an independent third party. Data returned to an AI Client is transmitted to, and processed by, the AI Client and its provider under the provider’s own terms, privacy notice, and data-retention and model-training settings—not under this Notice. The Customer, not Structum, selects the AI Client, agrees to its terms, and is responsible for configuring it (including any settings that control whether the provider retains or trains on the data). Structum does not control, and is not responsible for, the AI Client provider’s processing.

• Human confirmation for consequential actions. Actions initiated through an AI Client that would move money, send communications outside the Customer’s organization, or make irreversible changes are prepared as previews and require an Authorized User to confirm them in the Services before they take effect. Structum may change or add confirmation requirements at any time.

• Structum logs the connection. Structum records the AI Client’s tool and API calls, the data returned, proposed and confirmed actions, and related metadata for security, audit, support, abuse prevention, and Customer visibility, as described in Sections 5.6 and 5.8.

• Revocation. A Customer administrator or Authorized User may revoke an AI Client’s authorization at any time through the Services. Revocation stops future access but does not retrieve or delete data the AI Client or its provider already received.

If Structum lists a connector in a third-party AI directory or marketplace, the listing does not make the directory operator or AI Client provider Structum’s subprocessor, and this Notice—not the directory’s terms—governs Structum’s own processing.

10. Connected Accounts, Google Workspace, Microsoft, and Other Integrations

10.1 General Integration Principles

Integrations are optional unless a Customer contract states otherwise. Before connecting an account, the authorization screen identifies the requested permissions. Users and administrators should grant only the permissions needed for the intended feature. Structum uses connected-account data to provide user-facing functionality requested by the user or Customer, maintain the integration, protect security, troubleshoot, and comply with law. Structum does not use connected email, files, calendars, or contacts for unrelated advertising.

A Customer administrator may authorize an integration for an organization or domain and may control which users and data are available. Revoking an integration may stop future access but may not automatically delete data already imported, indexed, copied into a project, included in an audit log, or retained under the Customer agreement. Users may also need to revoke authorization through the third-party provider’s account settings.

10.2 Google API Data

Google Limited Use disclosure. Structum’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Depending on the feature and scopes authorized, Structum may access Google identity information, Gmail messages and metadata, Calendar events, Contacts, Drive files and metadata, shared-drive information, or other Google Workspace data. Structum accesses this data only after the user or authorized administrator grants permission and only for the prominent user-facing features described in the Services and authorization flow, such as authentication, searching or organizing project communications, importing or linking documents, synchronizing events, drafting or sending a user-directed message, generating a requested summary, or automating a Customer-configured workflow.

Structum may store authorization tokens, selected or synchronized records, indexes, embeddings, outputs, and audit metadata to provide the requested feature. Structum does not transfer Google user data to advertising platforms, data brokers, or information resellers; does not use it for serving ads, retargeting, or interest-based advertising; does not use it to determine creditworthiness or lending eligibility; and does not sell it. Structum does not use Google user data to create, train, or improve generalized or non-personalized artificial-intelligence or machine-learning models. Where an AI Feature processes Google user data (for example, to summarize or classify a message the user selected), the data is transmitted to Structum’s AI subprocessors only as necessary to deliver that user-facing feature and subject to the restrictions in Section 9. Google user data is disclosed to an AI Client only if the user directs the AI Client to retrieve it through the Services as described in Section 9.8.

Humans are not permitted to read Google user data except when the user has affirmatively agreed to access specific content for support or another disclosed purpose, when access is necessary for security or abuse investigation, when required by law, or when the data is aggregated and used for lawful internal operations. Structum requires personnel, agents, contractors, and successors to comply with applicable Google data-use restrictions.

Users may disconnect Google access through Structum settings, Google account permissions, or an administrator’s Google Workspace controls. Following disconnection or a valid deletion request, Structum deletes or deidentifies Google user data under the applicable Customer agreement, retention criteria, legal holds, security requirements, and backup rotation.

10.3 Microsoft and Other Provider Data

If a user or Customer connects Microsoft 365, Outlook, Teams, SharePoint, OneDrive, Azure, or another provider, Structum may access identity, email, calendar, contact, file, meeting, tenant, and metadata within the approved permissions. Structum uses and discloses that information only to provide the requested integration, maintain security, troubleshoot, comply with law, and carry out other purposes clearly disclosed at authorization. The provider’s own terms and privacy notice apply to the provider’s independent processing.

11. How We Disclose Personal Information

Structum may disclose Personal Information to the categories below. “Disclosure” does not necessarily mean a sale. Structum seeks to limit disclosure to information reasonably necessary for the disclosed purpose and uses contracts or other safeguards where required.

• Customers, administrators, and Authorized Users. Customer administrators may access account, permission, audit, usage, and Customer Content information; add or remove users; configure retention and integrations; export records; and otherwise manage the Customer environment.

• Project participants and recipients. Information is disclosed when a user shares a project, sends a message, creates a public or restricted link, invites a collaborator, routes a workflow, exports a report, or otherwise directs disclosure.

• Service providers and subprocessors. Hosting, cloud infrastructure, databases, storage, content delivery, security, identity, authentication, analytics, communications, customer support, implementation, billing, payment, transcription, document processing, AI, and other vendors process data for Structum under applicable restrictions.

• Merchant of record. Structum sells paid subscriptions through Paddle.com Inc., Paddle.com (Canada) Ltd, or Paddle.com Market Limited, as identified in the checkout (“Paddle”), as its authorized reseller and merchant of record. Paddle collects payment-card, billing-contact, billing-address, and tax information directly in its checkout and processes it under Paddle’s own privacy notice as an independent controller or business for payment processing, invoicing, tax, fraud prevention, and legal compliance. Structum shares account and billing-contact information with Paddle to set up and administer the Subscription and receives transaction, subscription, and payment-status information from Paddle.

• Integration and platform providers. Data is disclosed to a third-party service when a user or Customer connects, invokes, or directs an integration, including email, calendar, file, project, accounting, identity, or automation services. The integration provider processes the data under its own terms as an independent controller or business.

• AI Clients. Data is disclosed to a third-party AI Client, and to its provider, when a Customer or Authorized User connects the AI Client to the Services through our MCP server or API and directs it to retrieve or act on Customer data, as described in Section 9.8. The AI Client provider is an independent third party chosen by the Customer, not Structum’s service provider or subprocessor.

• Professional advisers and business providers. Lawyers, auditors, accountants, insurers, lenders, consultants, and other advisers may receive information when reasonably necessary for professional services, risk management, financing, corporate governance, or legal claims.

• Government authorities and legal recipients. Structum may disclose information in response to lawful process, court orders, subpoenas, regulatory requests, tax or sanctions obligations, public-safety needs, or other legal duties. Where permitted and appropriate, Structum may notify the Customer before disclosing Customer Content.

• Protection and enforcement recipients. Structum may disclose information when reasonably necessary to investigate fraud, abuse, security incidents, violations, threats, harm, illegal activity, or disputes; protect rights, property, systems, safety, or evidence; and enforce agreements.

• Corporate transaction parties. Information may be disclosed or transferred in connection with due diligence, financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to confidentiality and legally required notice or consent.

• Affiliates. Structum may disclose information to its Affiliates (identified in Section 3) for the purposes in this Notice, subject to consistent protections and applicable law. In practice this means: (a) Structum AI IP L.L.C., which owns and licenses the Structum AI platform and engages the individual software-development and maintenance contractors who build and support it, and whose contractors may access Services infrastructure and data when necessary to develop, maintain, secure, or support the Services under written confidentiality, security, and data-protection obligations; and (b) Castellum Capitalium LLC, the manager of both Structum entities, whose access is limited to management, governance, financial, legal, and compliance functions. Affiliates do not use Personal Information for their own independent purposes.

• At your or the Customer’s direction. Structum discloses information when a user or Customer requests, authorizes, consents to, or reasonably expects the disclosure.

• Deidentified and aggregate information. Structum may disclose information that is not Personal Information under applicable law, provided applicable deidentification commitments are maintained.

12. Sale, Sharing, Targeted Advertising, and Opt-Out Signals

Structum does not sell Customer Content. Structum does not sell Personal Information for monetary consideration. Structum does not disclose Customer Content, connected email, project documents, or Sensitive Personal Information to data brokers or for cross-context behavioral advertising.

Some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly enough to include disclosures of public-website identifiers or internet activity through certain analytics, advertising, social-media, or campaign technologies, even when no money is paid. If Structum enables technology that falls within those definitions, Structum will provide the legally required notice and controls, and the disclosure will be limited to public-site or marketing data rather than Customer Content.

Where applicable, you may opt out by emailing privacy@structumai.io, using any privacy-choice or cookie-preference control made available on the relevant Structum website, or using a legally recognized opt-out preference signal such as Global Privacy Control. Structum will process an applicable signal for the browser or device that sends it and will associate it with an account where required and reasonably identifiable. We do not knowingly sell or share Personal Information of individuals under 16.

Structum does not offer a financial incentive or price difference in exchange for Personal Information unless a separate Notice of Financial Incentive is provided before participation.

13. Cookies and Similar Technologies

Structum and its providers may use cookies, local storage, pixels, tags, SDKs, and similar technologies on websites and applications. The specific technologies depend on the property, device, region, consent, and Customer configuration.

• Strictly necessary technologies support authentication, session continuity, load balancing, security, fraud prevention, preferences required to provide the Services, and other core operations.

• Functional technologies remember optional preferences, enable integrations, support chat or media, and improve convenience.

• Analytics technologies measure traffic, performance, errors, feature use, and campaign effectiveness and help Structum improve the Services.

• Advertising or social-media technologies, if enabled, measure campaigns, limit repetition, or support interest-based advertising on third-party services. These technologies are not used with Customer Content and are subject to applicable consent and opt-out rights.

You may manage non-essential technologies through any cookie-preference control made available on the relevant Structum website and through browser or device settings. Structum does not currently designate a standalone cookie-settings URL. Applicable privacy-choice requests may also be submitted to privacy@structumai.io. Blocking technologies can affect functionality. Because “Do Not Track” is not a uniform legal standard, Structum does not respond to ordinary Do Not Track signals except where required; Structum does honor legally recognized opt-out preference signals where applicable.

14. Shared Workspaces, Administrators, Collaborators, and Public Links

The Services are collaborative. Information associated with a Customer account may be visible to the Customer’s administrators and other users based on permissions. Administrators may view account details, project activity, usage, permissions, audit events, and Customer Content; configure integrations; reset access; export or delete records; and restrict or terminate accounts. Structum is not responsible for a Customer’s independent use of information obtained through its account.

When a user sends a communication, shares a file, invites a person, creates a link, publishes content, or connects an external system, recipients may copy, download, export, forward, retain, or independently use the information. Public or broadly shared links can be accessed by anyone who obtains the link unless further controls are enabled. Deleting the source record may not delete copies already exported, forwarded, lawfully retained, or stored in another person’s account or system.

Users should review recipients, permissions, link settings, and integration scopes before sharing. Customers are responsible for configuring access consistent with project confidentiality, employment, safety, trade-secret, public-record, and contractual duties.

15. Retention, Deletion, Backups, and Legal Holds

Structum retains Personal Information only for as long as reasonably necessary and proportionate for the disclosed purpose, the Customer’s instructions and agreement, applicable retention settings, security and continuity, legal obligations, disputes, and legitimate business needs. Because the Services process construction and business records with different retention duties, periods vary by Customer, data category, feature, and jurisdiction.

A valid legal hold, investigation, subpoena, court order, audit, public-record preservation instruction, insurance requirement, dispute, or anticipated claim may suspend deletion for covered records. Structum limits access to preserved records and deletes them when the preservation basis ends and no other retention ground applies.

Deletion from active systems may not be immediate in every component. Data may remain temporarily in caches, logs, replicas, or backups until overwritten under normal processes. Structum may retain minimal records necessary to document a request, honor an opt-out, protect security, prevent fraud, establish deletion, or comply with law. Information that has been deidentified or aggregated may be retained if maintained in that form.

A deletion request may not remove information controlled by a Customer, held in another user’s account, included in a public record, exported to a third party, necessary to complete a transaction, needed for security or legal claims, or subject to another lawful exception. Structum will explain material limitations when required.

16. Security and Security Incidents

16.1 Security Program

Structum maintains a risk-based information security program designed to protect the confidentiality, integrity, and availability of Personal Information against unauthorized access, acquisition, use, alteration, disclosure, destruction, or loss. Depending on the Service component, plan, data type, and configuration, safeguards may include tenant isolation, role-based access controls, least-privilege administration, authentication controls, audit logging, encryption in transit, encryption at rest for designated systems or fields, secure development practices, vulnerability management, monitoring, backups, incident response, personnel confidentiality obligations, and vendor risk management.

Security is a shared responsibility. Customers and users must protect credentials and devices, use appropriate authentication, review permissions, promptly remove former users, configure integrations and public links carefully, avoid unauthorized data, maintain endpoint and network security, and report suspected compromise. No method of transmission, storage, or security control can guarantee absolute security.

16.2 Security Reports

Report suspected vulnerabilities or security incidents to security@structumai.io. Do not include unnecessary Personal Information, exploit data, or confidential Customer Content in an initial report. Structum may request additional information through a secure channel and may publish or maintain a separate vulnerability-disclosure policy.

16.3 Incident Response and Notification

Structum investigates suspected incidents, takes appropriate containment and remediation measures, and provides notifications required by applicable law and Customer contracts. For Customer Content, Structum generally notifies the affected Customer, which determines any notices to individuals or authorities unless law requires Structum to notify directly. Notification timing and content depend on the facts, legal definitions, law-enforcement needs, risk, contractual requirements, and available information.

17. International Data Transfers

Structum is based in the United States and hosts the Services with U.S.-headquartered cloud infrastructure providers. Personal Information may be processed or accessed in the United States and in other countries where Structum, its Affiliates, their contractors, Customers, AI Clients, or service providers operate. These countries may have data-protection laws different from those in your location.

Remote access by engineering contractors. Software development, maintenance, and technical support for the Services are performed in part by individual independent contractors engaged by our Affiliate Structum AI IP L.L.C., some of whom are located outside the United States (currently in Vietnam). Those contractors may access Services infrastructure, databases, and stored files when necessary to develop, maintain, secure, or troubleshoot the Services. Each is bound by a written agreement that includes confidentiality, intellectual-property, security, and personal-data obligations; requires least-privilege use of access; prohibits copying data to unauthorized systems, submitting Customer data to external AI tools without written approval, and using data to train models; prohibits selling, sharing, scraping, enriching, or profiling Personal Information; and requires prompt reporting of suspected security incidents. Structum treats this access as processing on its behalf and remains responsible for it under this Notice and applicable Customer agreements.

Where required for a restricted transfer, Structum uses an approved legal mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another legally recognized safeguard. Structum and a Customer may address transfers through the DPA. A copy or summary of an applicable safeguard may be requested at privacy@structumai.io, subject to redaction of confidential or security-sensitive terms.

Transfer mechanisms do not eliminate lawful access requirements in the destination country. Structum evaluates and implements supplementary contractual, organizational, and technical measures where required and appropriate to the nature and risk of the transfer.

18. Your Privacy Rights and Choices

18.1 Rights That May Apply

Depending on your jurisdiction, the processing context, and Structum’s role, you may have the right to:

• confirm whether Structum processes your Personal Information and access categories, sources, purposes, recipients, and specific information;

• correct inaccurate Personal Information;

• delete Personal Information, subject to exceptions;

• obtain a portable copy of information you provided or, where required, transmit it to another entity;

• restrict or object to certain processing, including direct marketing and processing based on legitimate interests;

• withdraw consent prospectively where processing relies on consent;

• opt out of sale, sharing, targeted advertising, or qualifying profiling;

• limit certain uses or disclosures of Sensitive Personal Information;

• obtain information about and exercise rights concerning qualifying automated decision-making;

• request a list of categories or, where required, specific third parties that received Personal Information;

• appeal a denial of a privacy request;

• receive equal service and not be unlawfully discriminated against for exercising privacy rights; and

• complain to a data-protection authority, attorney general, or other regulator.

18.2 How to Submit a Request

Submit a request by emailing privacy@structumai.io. Structum does not currently designate a separate privacy-request webform. Include your name, account email, organization, relationship to Structum, jurisdiction, and the right you are exercising. Do not send passwords, full government identifiers, or unnecessary Customer Content. For marketing email, use the unsubscribe link or email privacy@structumai.io. For cookie and advertising choices, use the controls described in Sections 12 and 13.

18.3 Verification

Structum may verify a request using an authenticated account, email confirmation, information already maintained, Customer confirmation, or other proportionate method. Structum uses verification information only to process the request, prevent fraud, maintain a compliance record, and protect rights and security. If identity cannot be reasonably verified, Structum may limit or deny the request as permitted by law.

18.4 Authorized Agents

An authorized agent may submit a request where permitted. Structum may require proof of authorization and may contact the individual directly to verify identity and authority, unless a valid power of attorney or law provides otherwise. Opt-out requests will not require verification beyond what is reasonably necessary to identify the relevant browser, device, account, or person.

18.5 Timing, Fees, and Appeals

Structum responds within the period required by applicable law and may extend the response period when permitted. Requests are generally free, but Structum may charge a lawful fee or decline a request that is manifestly unfounded, excessive, repetitive, technically infeasible, fraudulent, or subject to an exception. If a request is denied, Structum will provide the explanation and appeal instructions required by law. Appeals may be submitted to privacy@structumai.io with the subject “Privacy Appeal.”

18.6 Requests for Customer Content

When the request concerns Customer Content, contact the relevant Customer. Structum may forward the request to the Customer, request the Customer’s instructions, or provide tools for the Customer to respond. Structum may not disclose Customer Content directly if doing so would conflict with the Customer’s legal role, contract, confidentiality obligations, public-record procedure, or the rights of others.

18.7 Exceptions

Rights are subject to legal limitations. Structum may retain or continue processing information when necessary to provide a requested service, complete a transaction, protect security, prevent fraud, comply with law, preserve public or construction records, exercise or defend claims, respect another person’s rights, maintain confidential business information, or satisfy another lawful exception. Structum will not provide passwords, authentication secrets, security logic, privileged material, or information that would create a disproportionate risk to another person or system.

19. Supplemental U.S. State Privacy Disclosures

Residents of U.S. states with comprehensive privacy laws may have the rights described in Section 18. Depending on the state, those rights may include access, correction, deletion, portability, opt-out of sale or targeted advertising, opt-out of qualifying profiling, consent for Sensitive Personal Information, withdrawal of consent, a list of third-party recipients, appeal, and recognition of an approved universal opt-out mechanism.

Structum does not sell Personal Information for money and does not sell or share Customer Content for targeted advertising. If optional public-website advertising technology constitutes sale, sharing, or targeted advertising under a state law, use the privacy controls or a recognized opt-out preference signal. Structum will obtain consent before processing Sensitive Personal Information where the law requires consent and Structum—not the Customer—is responsible for the processing.

Nevada residents may request that Structum not make a covered sale of covered information. Structum does not currently make covered sales as defined by Nevada law, but requests may be sent to privacy@structumai.io. Rights under state law do not necessarily apply to information processed in a business, employment, or Customer-service-provider context, though Structum may honor requests voluntarily when feasible and appropriate.

20. California Privacy Notice and Notice at Collection

20.1 Scope and Roles

This Section 20 supplements the rest of this Notice for California residents and also serves as a Notice at Collection under the California Consumer Privacy Act, as amended (“CCPA”), to the extent the CCPA applies to Structum. It describes practices during the preceding 12 months and expected practices going forward. CCPA terms such as “business,” “consumer,” “personal information,” “sensitive personal information,” “service provider,” “contractor,” “sell,” and “share” have the meanings given by the CCPA.

For Customer Content processed solely as a service provider or contractor, the Customer is the business responsible for the CCPA request and notice. Structum assists the Customer as required by contract and law. For Structum-controlled Personal Information, Structum is the business responsible for the disclosures and rights below.

20.2 Categories of Personal Information Collected and Disclosed

The following table describes categories Structum has collected during the preceding 12 months or may collect depending on the Services, features, integrations, and Customer Content used. “Disclosed” includes disclosure to service providers, contractors, Customers, authorized users, integrations, professional advisers, authorities, and transaction counterparties for the business purposes described in this Notice. Customer Content is not sold or shared for cross-context behavioral advertising.

20.3 Business and Commercial Purposes

Structum collects, uses, and discloses the categories above for the purposes in Sections 7, 9, 10, 11, 13, 15, and 16, including providing services; account and project administration; processing Customer instructions; security and integrity; debugging; short-term transient use; communications; billing; analytics; service improvement; legal compliance; and internal uses reasonably aligned with the relationship and context.

20.4 Categories Sold, Shared, or Disclosed for a Business Purpose

Structum has not sold Personal Information for monetary consideration. Structum does not sell or share Customer Content or Sensitive Personal Information. If optional advertising or campaign technology is enabled on Structum’s public website, identifiers, internet or network activity, approximate location, commercial interest information, and related marketing inferences may be disclosed in a manner treated as sale or sharing. Structum provides applicable opt-out controls. Structum discloses the categories in the table to the recipient categories identified there for business purposes.

20.5 California Rights

Subject to the CCPA’s scope and exceptions, California consumers may request to know, access, correct, or delete Personal Information; receive a portable copy; opt out of sale or sharing; limit certain uses or disclosures of Sensitive Personal Information; exercise applicable rights concerning automated decision-making technology; and receive non-discriminatory treatment. Submit requests, including applicable opt-out or limitation requests, by emailing privacy@structumai.io. Structum does not currently designate a separate privacy-request webform or privacy-choices URL. Applicable opt-out requests may also be submitted through any privacy-choice control made available on the relevant Structum website or through a recognized preference signal.

Structum does not use or disclose Sensitive Personal Information for purposes that require a right to limit unless a feature-specific disclosure states otherwise. If that changes, Structum will provide the required “Limit the Use of My Sensitive Personal Information” method before the additional use begins.

20.6 Authorized Agents and Verification

California consumers may use an authorized agent. Structum follows the verification and authorization process described in Section 18. Structum will not require account creation solely to opt out and will use request-verification information only for verification and compliance.

20.7 Minors, Financial Incentives, and Direct Marketing Disclosures

Structum does not knowingly sell or share Personal Information of consumers under 16. Structum does not offer a CCPA financial incentive unless a separate legally compliant notice is provided. Structum does not disclose Personal Information to third parties for their own direct-marketing purposes in a manner that requires a customer-list disclosure under California’s “Shine the Light” law; questions may be sent to privacy@structumai.io.

20.8 California Contact

California privacy questions and requests may be sent to privacy@structumai.io or 8 The Green, Suite B, Dover, DE 19901, United States. The California section will be reviewed and updated at least annually while applicable.

21. Additional Notice for the EEA, United Kingdom, and Switzerland

21.1 Controller and Processor Roles

For Structum-controlled processing, the controller is the Structum Operating Entity identified in Section 28 (as of the Last Updated date, Structum AI LLC, a Delaware limited liability company), 8 The Green, Suite B, Dover, DE 19901, United States. For Customer Content, the Customer is generally the controller and Structum is the processor. Contact the Customer first for Customer Content. Structum’s DPA governs processor commitments and international transfers for enterprise Customers.

21.2 Required Information and Consequences

Certain account, authentication, billing, and project information is required to provide the Services. If required information is not provided, Structum may be unable to create an account, authenticate access, provide a requested feature, process payment, or perform the contract. Optional fields and integrations are identified by context. Sources, purposes, legal bases, recipients, and retention criteria are described in Sections 5 through 17.

21.3 Data-Subject Rights

Subject to applicable law, you may request access, rectification, erasure, restriction, portability, or information about recipients; object to processing based on legitimate interests or direct marketing; withdraw consent; and exercise rights relating to solely automated decisions producing legal or similarly significant effects. You may lodge a complaint with the supervisory authority where you live, work, or believe an infringement occurred. UK residents may complain to the Information Commissioner’s Office. Swiss residents may contact the Federal Data Protection and Information Commissioner.

21.4 Direct Marketing and Objection

You may object to direct marketing at any time, including related profiling. Structum will stop the marketing processing, but may retain a suppression record. For other objections based on legitimate interests, Structum may continue processing if it demonstrates compelling legitimate grounds or the processing is needed for legal claims, as permitted by law.

21.5 Automated Decision-Making

Structum does not make solely automated decisions in its controller capacity that produce legal or similarly significant effects. If that practice changes, Structum will provide the information, legal basis, safeguards, and rights required by law, including meaningful information about the logic involved and the significance and envisaged consequences where applicable.

21.6 International Transfers and Representatives

International-transfer safeguards are described in Section 17. As of the Last Updated date, Structum has not appointed an EEA representative, a UK representative, or a Data Protection Officer. Structum will appoint or designate such a person or representative if required by applicable law. Until then, privacy inquiries may be sent to privacy@structumai.io.

22. Canada and Other Jurisdictions

Canadian residents may request access to and correction of Personal Information controlled by Structum and may withdraw consent, subject to contractual and legal restrictions. Withdrawal does not affect prior lawful processing and may prevent Structum from providing a feature that depends on the information. Privacy questions and complaints may be sent to privacy@structumai.io. Structum will investigate and respond as required by applicable federal or provincial law.

Residents of other jurisdictions may have additional rights under local law. Submit the request using Section 18. Structum will apply the rights and procedures required by the law applicable to the specific person, processing, and Structum entity. Nothing in this Notice limits a non-waivable privacy right.

23. Children and Minors

The Services are business tools and are not directed to children. Individuals must be at least 18 years old, or the age of legal majority in their jurisdiction, to create an independent account or accept the Services’ terms unless Structum expressly authorizes another arrangement in writing. Structum does not knowingly collect Personal Information online directly from a child under 13 in a manner subject to the U.S. Children’s Online Privacy Protection Act without required parental authorization and notice.

Customers must not invite minors or submit children’s data unless the Customer has authority, the use is appropriate for the Services, and all required notices, consents, and contractual protections are in place. If Structum learns that it directly collected a child’s Personal Information contrary to this section, Structum will delete or otherwise address it as required. Contact privacy@structumai.io with sufficient details to identify the account or record.

24. Public-Sector Customers, Public Records, and Construction Record Duties

Construction projects may involve government entities, public funds, regulated owners, audits, open-record or freedom-of-information laws, procurement rules, prevailing-wage records, certified payroll, safety records, permits, inspections, claims, bonds, insurance, litigation, and statutory retention duties. A Customer may be legally required to preserve or disclose Customer Content even when an individual requests deletion or confidentiality.

The Customer—not Structum—determines whether Customer Content is a public record, exempt record, project record, employment record, safety record, privileged record, or other legally regulated record and is responsible for responding to public-record and discovery requests. Structum may preserve, export, search, or disclose records at the Customer’s documented direction or as required by law. Structum cannot guarantee that data submitted to a public entity or public project will remain confidential.

25. Data Requiring Special Arrangements

Unless an Order Form, DPA, business associate agreement, security addendum, or other signed writing expressly authorizes it, the Services are not designed for: protected health information regulated by HIPAA; full payment-card authentication data subject to PCI DSS storage restrictions; government-classified information; criminal justice information subject to CJIS requirements; export-controlled technical data; substance-use-disorder records; biometric identifiers used for recognition; consumer reports governed by the Fair Credit Reporting Act; children’s data requiring parental consent; or other information that requires specialized controls not included in the Customer’s plan.

Customers must not submit such data without written authorization and required configuration. Unauthorized submission does not expand Structum’s contractual role or create obligations inconsistent with the agreement, though Structum will handle discovered Personal Information in accordance with applicable law. Structum may suspend processing, restrict access, require migration, or securely delete unauthorized data when permitted by contract and law.

26. Third-Party Services and External Links

The Services may link to, embed, interoperate with, or permit access to third-party products and websites. A Customer or user may direct Structum to transfer data to a third party. The third party’s privacy notice and terms govern its independent processing. Structum is not responsible for a third party’s practices, security, availability, accuracy, or use of information after a user or Customer directs the disclosure, except to the extent applicable law or a written agreement provides otherwise.

27. Changes to This Notice

Structum may update this Notice to reflect changes in law, technology, Services, vendors, business practices, or organizational structure. The “Last Updated” date identifies the current version. Structum may provide additional notice through the Services, email, a website banner, an account administrator, or another appropriate method when a change is material. Where law requires consent for a new purpose, Structum will obtain it before applying the new purpose to affected Personal Information.

Material changes will apply prospectively unless law permits otherwise. Prior versions may be retained for compliance and made available on request where required.

28. Contact Information

Privacy contact (requests, opt-outs, appeals): privacy@structumai.io

Security reports: security@structumai.io

Legal notices, subpoenas, and legal process: legal@structumai.io

Support and text-message (SMS) opt-out assistance: support@structumai.io

Website and platform: structumai.build (structumai.io is used for email only)

Legal entity (Structum Operating Entity): Structum AI LLC, a Delaware limited liability company (Delaware File No. 10591082). Structum AI LLC is expected to convert into a Delaware corporation named Structum AI, Inc.; upon conversion the same entity continues and this Notice will be updated to reflect the new name.

Mailing address: 8 The Green, Suite B, Dover, DE 19901, United States

Privacy request form: No standalone webform currently designated; email privacy@structumai.io.

Privacy choices / opt-out: No standalone URL currently designated; email privacy@structumai.io, use any available privacy-choice control, or send a recognized opt-out preference signal.

Data Protection Officer: Not appointed; contact privacy@structumai.io.

For accessibility assistance or an alternative format, email privacy@structumai.io and describe the requested format. Please do not send passwords, full payment-card numbers, or unnecessary Sensitive Personal Information by ordinary email.

29. Relationship to Customer Agreements and Supplemental Notices

This Notice describes Structum’s general privacy practices. The Order Form, Terms of Service, DPA, security addendum, business associate agreement, feature-specific notice, AI Transparency Notice, Cookie Notice, or other signed agreement may provide additional or more specific terms. For Customer Content, the DPA and applicable Customer agreement control in the event of a direct conflict concerning Structum’s processor obligations. For Structum-controlled processing, this Notice and any context-specific notice apply. Nothing in this paragraph limits a non-waivable right under applicable law.

A Customer’s separate privacy notice governs the Customer’s independent collection and use of Customer Content. Structum’s provision of tools, retention settings, AI Features, or integrations does not determine the Customer’s legal compliance or transfer the Customer’s statutory duties to Structum.

Except to the extent applicable law expressly provides otherwise, this Notice states general privacy practices and is not intended to create contractual rights, third-party-beneficiary rights, fiduciary duties, warranties, or remedies independent of an applicable written agreement or non-waivable law. Structum does not waive any defense, privilege, immunity, contractual protection, or limitation available under law or an applicable agreement. Disputes relating to a Customer’s or user’s use of the Services remain subject to the governing-law and dispute-resolution provisions of the applicable agreement, except to the extent a non-waivable privacy right or remedy applies.

If a provision of this Notice is determined to be invalid or unenforceable in a particular context, it will be interpreted to the maximum extent permitted by law, and the remaining provisions will continue to apply. A delay or failure to enforce a provision does not waive it.