Privacy Policy

This Privacy Policy ("Policy") applies to information UMIP collects from or about you when you visit, access, register for, or use the Platform, communicate with UMIP, or otherwise interact with UMIP's services.

This Policy does not apply to:

• information about parcels, properties, addresses, buildings, or infrastructure that does not constitute personal information about you;
• third-party websites or services that link to or from the Platform;
• information UMIP processes solely on behalf of an enterprise customer under a separate written enterprise agreement (such customer's own privacy policy governs); or
• job applicants, employees, contractors, and independent contractors of UMIP, who are covered by a separate notice.

The Platform is offered only to users located in the United States. The Platform is not offered or available to, and UMIP does not knowingly collect information from, users in the European Union, the United Kingdom, the European Economic Area, Switzerland, Canada, or any other jurisdiction outside the United States. If you are located outside the United States, do not use the Platform.

This Policy is effective on the date indicated above. UMIP may update this Policy from time to time; see Section 14.

UMIP licenses, purchases, or otherwise obtains data from third-party data providers to compile Reports. Most of that data is about parcels, properties, addresses, buildings, and infrastructure and is not personal information about you. To the extent any information obtained from third parties does relate to you (for example, identity verification, fraud prevention, or marketing enrichment data), UMIP treats it consistently with this Policy.

UMIP may also receive information from:

• payment processors and financial-services providers;
• identity-verification, fraud-prevention, and anti-money-laundering vendors;
• analytics, advertising-measurement, and marketing vendors;
• public sources, government records, and publicly available datasets; and
• other users (e.g., if a user submits content that identifies you).

UMIP does not intentionally collect sensitive personal information as defined under the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") or under other state privacy laws. UMIP does not knowingly collect Social Security numbers, driver's-license numbers, state-ID numbers, financial-account credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, biometric data for unique identification, health information, or information about sex life or sexual orientation.

If you submit any such information voluntarily (for example, by providing it in a support request), UMIP will treat it as confidential and use it only as necessary to respond.

The Platform is not a consumer reporting agency. UMIP does not collect or sell information for any purpose regulated by the federal Fair Credit Reporting Act ("FCRA"), and Reports are not consumer reports.

UMIP shares information with service providers, processors, and contractors who help UMIP operate the Platform, including:

cloud hosting and infrastructure providers;

payment processors and fraud-prevention providers;

identity-verification and anti-money-laundering vendors;

email and communications providers;

analytics, performance-monitoring, and error-reporting providers;

customer-support and help-desk providers;

security, logging, and audit providers;

marketing and advertising-measurement providers (only as permitted by your choices); and

professional advisors (e.g., legal, accounting, audit).

These service providers are contractually limited to processing information for UMIP's purposes and consistent with this Policy.

UMIP licenses, purchases, or otherwise obtains data from third-party data providers to compile Reports. As described in Section 2.3, most such data is about parcels, properties, addresses, buildings, and infrastructure rather than personal information about you. Where personal information is shared with a third-party data or services provider (for example, for identity verification or fraud prevention), it is shared only as necessary and consistent with this Policy.

UMIP may disclose information when UMIP, in good faith, believes that disclosure is necessary to:

• comply with applicable law, court order, subpoena, regulatory request, or other legal process;
• enforce the Terms of Service and other agreements;
• protect the rights, property, or safety of UMIP, users, customers, or the public;
• detect, investigate, prevent, or respond to fraud, security incidents, unauthorized access, or other prohibited activity; or
• establish or exercise legal rights or defend against legal claims.

If UMIP is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred or disclosed as part of that transaction, subject to standard confidentiality protections.

UMIP may share information with other parties at your direction or with your consent (for example, when you choose to share a Report with a professional advisor).

UMIP may disclose aggregated or de-identified information that no longer reasonably identifies you for any lawful purpose, including analytics, research, marketing, and product development.

UMIP does not sell your personal information for money. Whether certain disclosures constitute a "sale" or "sharing" under the CCPA/CPRA or similar state laws depends on the specific definitions and your choices. See Section 8 for your rights and the related disclosures.

Category Purpose Can You Disable?

Required for authentication, security, fraud prevention, and No — required for the Platform Strictly necessary core functionality to operate

Functional Remember preferences, language, session state Yes, via your choices below

Analytics and Understand how the Platform is used, measure Yes, via your choices below performance performance, diagnose errors

Marketing and Only if you opt in to marketing; measure marketing Yes, via your choices below measurement effectiveness

You can manage Cookies through:

• the in-Platform cookie preference center (where applicable);
• your browser settings (most browsers allow you to refuse or delete cookies); and
• Global Privacy Control ("GPC") and similar opt-out signals. UMIP honors GPC signals as an opt-out of "sale" and "sharing" under the CCPA/CPRA and other state laws that recognize such signals.

Disabling some Cookies may impair Platform functionality.

The Platform does not respond to legacy "Do Not Track" browser signals, which have not been standardized. The Platform does respond to GPC and similar opt-out signals as described above.

Right Description

Request to know what personal information UMIP has collected, used, disclosed, sold, or shared, and to receive a copy.

Request that UMIP delete personal information UMIP has collected from you, subject to Right to Delete legal exceptions.

Right to Correct Request that UMIP correct inaccurate personal information.

Direct UMIP not to "sell" or "share" your personal information. UMIP does not sell personal Right to Opt Out of Sale or information for monetary consideration; you may opt out of "sharing" (cross-context Sharing behavioral advertising) at any time.

Right to Limit Use of Sensitive UMIP does not intentionally collect sensitive personal information; this right is honored by Information default.

Right to Non-Discrimination UMIP will not discriminate against you for exercising any privacy right.

Where applicable, opt out of profiling in furtherance of decisions that produce legal or Right to Opt Out of Profiling similarly significant effects. UMIP does not engage in such profiling for consumer-facing for Significant Decisions Platform use.

Right to Appeal Appeal UMIP's refusal of a rights request (where applicable).

You can submit a rights request by:

• emailing privacy@umipinc.com;
• using the "Your Privacy Choices" link in the Platform footer;
• writing to UMIP Inc., Attn: Privacy, 911 East McDonald Drive, Pilot Point, Texas 76258.

For your protection, UMIP will verify your identity before fulfilling a rights request. UMIP may request information sufficient to confirm your identity and your association with the account.

You may use an authorized agent to submit a rights request on your behalf. UMIP may require the agent to provide written authorization and may require you to verify your identity directly with UMIP. UMIP will respond within the timeframes required by applicable state law (generally 45 days, extendable once where permitted).

If UMIP denies a rights request in whole or in part, you may appeal by emailing privacy@umipinc.com with the subject line "Privacy Rights Appeal." UMIP will respond to appeals within the timeframes required by applicable state law (generally 45 to 60 days).

If you are a California resident:

(a) Notice at Collection. The categories of personal information UMIP collects, the purposes of collection, whether information is sold or shared, and retention periods are described in Sections 2, 3, 5, and 9. This Policy is provided to you at or before the point of collection.

(b) Right to Know / Access; Right to Delete; Right to Correct; Right to Opt Out of Sale/Share; Right to Limit; Right to Non-Discrimination. These rights are described in Sections 8.1 and 8.2.

(c) "Shine the Light" (Cal. Civ. Code § 1798.83). California residents may request information about UMIP's disclosure of personal information to third parties for those third parties' direct- marketing purposes. UMIP does not disclose personal information to third parties for those third parties' direct-marketing purposes.

(d) Sensitive Personal Information. UMIP does not intentionally collect sensitive personal information.

The following states have enacted privacy laws granting U.S. residents specific rights. UMIP provides those rights uniformly to U.S. residents per Section 8.1 and applies state-specific procedural requirements where they apply.

States with comprehensive privacy laws (as of the Last Updated date above): California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Kentucky, Minnesota, Maryland, Rhode Island, Nebraska, and others as enacted.

Nevada. Nevada residents may direct UMIP not to sell certain personal information by emailing privacy@umipinc.com. UMIP does not sell personal information.

Vermont. Vermont residents have specific opt-in requirements for certain information sharing. UMIP complies with applicable Vermont requirements.

If you have questions about rights under your state's law, contact privacy@umipinc.com.

UMIP uses automated systems, which may include machine-learning systems, only for the following limited operational purposes:

• compiling, generating, formatting, and improving Reports;
• detecting and preventing fraud, abuse, unauthorized extraction, and security threats;
• operating, maintaining, securing, and improving the Platform; and
• measuring and analyzing use of the Platform on an aggregated basis.

UMIP makes the following commitments to you regarding artificial intelligence:

(a) No Sale of Personal Information to AI Trainers. UMIP does not sell, rent, license, or otherwise make available your personal information to any third party for the purpose of training, fine-tuning, evaluating, grounding, or otherwise developing any artificial intelligence, machine-learning, large-language, foundation, multimodal, embedding, or similar model or system.

(b) No Training of Third-Party Models on Personal Information. UMIP does not use your personal information to train, fine-tune, evaluate, ground, or otherwise develop any third- party AI or ML model or system, and does not permit any third party that processes personal information on UMIP's behalf to do so. UMIP's contracts with service providers prohibit such use.

(c) No Training of Commercial Generative Models on User Content. UMIP does not use your User Content (as defined in the Terms of Service), your search history, your queries, or other content you submit to the Platform to train, fine-tune, evaluate, or otherwise develop any commercial generative AI model or system, whether operated by UMIP or by any third party.

(d) No Significant Automated Decisions Without Human Involvement. UMIP does not use solely automated processing — without meaningful human involvement — to make decisions about you that produce legal effects concerning you or similarly significantly affect you (such as decisions regarding credit, insurance, employment, housing, education, healthcare, essential goods or services, criminal justice, or eligibility for any government benefit). The Platform is not designed for, and the Reports are not intended to be used as, the basis for any such decision. See Section 2.5 (No FCRA Use) and the Terms of Service for further restrictions.

Where UMIP uses AI or ML internally for the limited purposes in Section 11.1, UMIP:

• does not transmit personal information to third-party generative AI services in a manner that would permit those services to retain, train on, or further use that information;
• restricts AI/ML access to personal information to the minimum necessary;
• maintains records, logging, and review processes appropriate to the use; and
• does not rely on AI output as the sole basis for any significant decision about a user.

If applicable state law grants you a right to information about, or to opt out of, profiling in furtherance of decisions that produce legal or similarly significant effects, UMIP will honor that right consistent with Section 8. To exercise such rights, contact privacy@umipinc.com.

UMIP does not guarantee the accuracy, completeness, currency, or appropriateness of any automated determination, AI-generated content, or ML output. See the Terms of Service for disclaimers and limitations of liability.

UMIP expressly reserves all rights against, and does not consent to, the use of any portion of the Platform, this Policy, the Reports, or any UMIP content by any third party for AI training, fine-tuning, evaluation, retrieval-augmented generation, text-and-data mining, or similar purposes. See the Terms of Service, Sections 5A and 5B, for the full scope of this reservation.