Privacy Policy Effective Date: October 31, 2026 1. Introduction AIEYU ("we," "us," or "our") operates U Navigate (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Platform. We take privacy seriously. The Platform serves individuals who may be navigating sensitive life circumstances including housing instability, health challenges, employment difficulty, and family system involvement. We recognize the heightened sensitivity of the information you share and commit to handling it with care, transparency, and respect. By using the Platform, you consent to the collection and use of information as described in this Privacy Policy. 2. Information We Collect Information You Provide Directly When you use the Platform, you may provide: • Account information: name, email address, phone number, date of birth • Profile information: address, city, state, zip code, sex, race and ethnicity • Assessment responses: answers to intake questions covering housing, employment, education, health, mental health, substance use history, safety concerns, foster care history, family composition, and financial circumstances • Presenting problem descriptions: free-text descriptions of your situation in your own words • Identity document status: whether you have a valid government-issued ID • Emergency contact information • Trusted contact: the name and phone number (or platform connection) of a person you choose to save, if you save one • Documents uploaded to the platform • Chat messages and interactions with the Lexi AI assistant • Wellbeing reflections and mood tracking entries • Feedback and communications you send to us Information Collected Automatically When you use the Platform, we automatically collect: • Device information: device type, operating system, browser type • Usage data: pages visited, features used, time spent, clicks • Log data: IP address, timestamps, error logs • Session data: assessment completion status, navigation path 3. How We Use Your Information We use your information to: • Provide, operate, and improve the Platform • Generate personalized support plans and resource recommendations • Localize resource recommendations to your geographic area • Enable progress tracking and task management features • Provide the Lexi AI chat and assessment functionality • Send account and service communications • Generate aggregated, de-identified analytics for product improvement • Detect and prevent fraud, abuse, and security incidents • Comply with applicable legal obligations We do not sell your personal information to third parties. We do not use your information for targeted advertising. We do not share individual-level personal information with government agencies except as required by law. Aggregated Analytics and Research We may use de-identified, aggregated data derived from Platform usage to understand population-level needs, resource gaps, and service trends. This aggregated data does not identify any individual. It may be shared with partner organizations, funders, or published in research reports to advance the mission of improving human services delivery. 4. Sensitive Information The following categories of information you may provide are considered sensitive under applicable law and receive heightened protection: • Health and mental health information • Substance use history • Safety and domestic violence disclosures • Sex • Race and ethnicity • Foster care and child welfare history We collect sensitive information only to the extent necessary to provide the Platform services. We do not use sensitive information for advertising, profiling for unrelated purposes, or any purpose inconsistent with providing you with a personalized support plan. 5. Minor Users We recognize that many Platform users are minors, including foster care youth and transition-age youth between the ages of 16 and 21. We apply heightened protections to information about minors: • We do not use information about minors for advertising purposes • We do not sell information about minors • We retain minor user data according to the retention schedule in Section 7, and no longer than necessary for the purposes described in this Policy • We provide minors with the ability to request deletion of their information For users under 13, we require verifiable parental or guardian consent before account creation. If we learn we have collected information from a user under 13 without required parental consent, we will delete that information promptly. 6. Disclosure of Your Information Service Providers We share your information with third-party service providers who assist us in operating the Platform, including: • Vercel (hosting) • Supabase (database and authentication) • OpenAI (for AI-powered features — see "AI Processing — OpenAI Specifics" below for what is and is not sent). When you upload a photo or screenshot of a document, we send that image to OpenAI so the words in it can be read into text. The image itself is sent, which means anything visible in the picture is sent. • Google (Google Places API, used to show places near you: our server sends Google the map coordinates for your profile ZIP code, never your name, your account, your address, or your device location, and we keep no copy of the results) • Resend (email) • Analytics providers (receiving de-identified data only) All service providers are contractually required to process your information only as directed by us and to maintain appropriate security measures. Sharing Documents with Others You may choose to share a document you have uploaded with another user. When you do, we create a consent record for that share, and access is checked on every open. You may revoke a share at any time, after which access ends. AI Processing — OpenAI Specifics We use OpenAI exclusively for AI-powered features in U Navigate by AIEYU. We do not currently use other AI providers such as Anthropic, Google, or Microsoft. If we add additional providers in the future, we will update this disclosure. What we send to OpenAI: • Messages you send to Lexi (the chat feature) • Information you enter on intake assessments and questionnaires • Voice recordings of you speaking to Lexi (transcribed via OpenAI's Whisper model) • Documents you upload, when referenced in a chat conversation • Case narratives, for users with admin access to the case review feature • For wellbeing insights: numeric and category signals derived from your check-ins (average mood score, mood trend, most recent mood label, top adjective and top influence) — these are aggregated values, not your reflection notes themselves • Each message you send to Lexi is also sent to OpenAI's moderation service, which screens it for signs of self-harm risk (see "How Lexi responds when things are heavy" in the AI Disclosure). The result shapes Lexi's reply and is never stored. • If you have saved a trusted contact, their name (never their phone number) is included with requests to OpenAI so Lexi knows who they are • If you have turned on "Let Lexi offer a first draft" and ask for one, your person's name is sent to OpenAI to write that draft. The draft is shown to you and is never stored. • When the Platform suggests a title for a journal entry, the beginning of that entry (up to about 2,000 characters) is sent to generate the title What stays on our servers (NOT sent to OpenAI): • Your wellbeing reflection notes — the words you write in reflections do not leave our servers; OpenAI only receives the derived signals listed above to generate the insight text • Your profile demographics (race, sex, identity fields, contact information) • Your password, payment information, and login credentials Photos are read differently than files. A PDF or Word file already has the words inside it, so we pull them out exactly. A photo has no words in it, only a picture of words, so the words have to be guessed at from the shapes. Most of the time the guess is right. Sometimes it is wrong, and a wrong guess can look just as confident as a right one — a date, a case number, or a name can come out changed without anything looking off. So we keep your photo, always, and treat the text as a helper rather than as the document. Before you rely on something the text says, check it against the picture. If you have the file itself rather than a photo of it, upload that instead. It will be read exactly. What OpenAI does with the data: • OpenAI keeps content sent to its API in abuse-monitoring logs for up to 30 days, then deletes it, per their Standard API terms. It keeps content longer only where the law requires it or where needed to prevent harm. • OpenAI uses these logs only to monitor for abuse of its services. • OpenAI does NOT use this content to train its AI models, per their Standard API terms. Legal Requirements We may disclose your information when required by applicable law, court order, or governmental authority. We will notify you of such requests to the extent permitted by law. Safety Emergencies We may disclose information without your consent if we believe in good faith that disclosure is necessary to prevent imminent harm to you or others. This is a narrow exception applied only to genuine safety emergencies. Business Transfers If AIEYU is acquired, merges with another entity, or transfers substantially all of its assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any material changes to how your information is handled. We Do Not Sell Your Information We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. 7. Data Retention We retain your information for as long as necessary to provide the Platform services and comply with legal obligations: • Active account data: retained while your account is active • Assessment data: retained for 7 years from the date of assessment to support longitudinal tracking and outcomes measurement • Chat history: retained for 24 months • Wellbeing data: retained for 5 years • Aggregated analytics: retained indefinitely in de-identified form You may request deletion of your account and associated data at any time by contacting shane@aieyu.ai. We will acknowledge your request and process it within 45 days. Some information may be retained where required by law or where necessary to resolve disputes. Content recently sent to OpenAI may remain in OpenAI's abuse-monitoring logs for up to 30 days after it was sent, and is then deleted on OpenAI's schedule. U Navigate is not your official case record. If you have worked with an agency, that agency and the state maintain their own records, which are governed by their policies and applicable law. Deleting your U Navigate data does not affect those records, and does not remove your ability to request a copy of your file from your agency. 8. Your Rights and Choices Depending on your location, you may have the following rights regarding your personal information: • Access: request a copy of the personal information we hold about you • Correction: request correction of inaccurate or incomplete information • Deletion: request deletion of your personal information, subject to legal exceptions • Portability: request your data in a machine-readable format • Restriction: request that we limit processing of your information in certain circumstances • Objection: object to processing based on legitimate interests • Opt-out of automated decision-making: request human review of AI-generated recommendations that significantly affect you To exercise any of these rights, contact us at shane@aieyu.ai. We will respond within 45 days. We may require identity verification before processing your request. California residents have additional rights under the CCPA/CPRA including the right to know what sensitive personal information is collected and to limit its use. We honor Global Privacy Control signals to the extent required by applicable law. 9. Security We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include: • Encryption of data in transit; data at rest is encrypted by our infrastructure providers • Access controls limiting data access to authorized personnel • Automated security checks that run as part of every code deployment, plus internal security audits; an independent third-party security assessment is planned and has not yet been performed • Row-level security policies on every database table holding user records Despite these measures, no security system is impenetrable. In the event of a data breach that affects your personal information, we will notify you as required by applicable law. 10. Cookies and Tracking The Platform keeps your signed-in session in your browser's local storage and uses a small number of functional cookies (for example, to keep a chat anchored to the right conversation). We use privacy-respecting analytics to understand aggregate usage. We do not use third-party advertising cookies. You may control cookies and local storage through your browser settings, though clearing or disabling them may sign you out or affect Platform functionality. 11. Changes to This Privacy Policy We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date and by prompting you to review the updated document the next time you use the Platform. You must accept the updated Privacy Policy to continue using the Platform. 12. Contact Us For questions, concerns, or to exercise your privacy rights: AIEYU Email: shane@aieyu.ai Response time: We aim to respond to all privacy inquiries within 10 business days.