PRIVACY POLICY

This Privacy Policy (“Policy”) describes how International Products Generated, Inc. d/b/a IPGen, a Delaware corporation (“IPGen,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, transfers, and protects Personal Data in connection with the IPGen platform, websites, applications, APIs, artificial intelligence and machine learning systems, and related services (collectively, the “Services”). This Policy applies to all users, customers, visitors, and individuals whose Personal Data is processed by IPGen, including business users, enterprise customers, university and research institutions, and government entities, to the extent applicable. This Policy is incorporated by reference into the IPGen Terms of Use, Data Processing Addendum, and any applicable Master Services Agreement or Order Form.

1. Scope and Applicability

This Policy applies to Personal Data processed by IPGen as a data controller or processor, as applicable, under:

- The General Data Protection Regulation (EU) 2016/679 (“GDPR”);

- The UK GDPR and Data Protection Act 2018;

- The California Consumer Privacy Act, as amended by the California Privacy Rights Act

(“CCPA/CPRA”);

- The Quebec Act Respecting the Protection of Personal Information in the Private Sector (Law

25);

- The Brazilian General Data Protection Law (LGPD);

- And other applicable data protection and privacy laws.

Where IPGen processes Personal Data on behalf of customers as a processor or service provider, such processing is governed by the Data Processing Addendum (“DPA”).

2. Definitions

“Personal Data” means any information relating to an identified or identifiable natural person, including personal information, personal data, and similar terms under applicable law. “Sensitive Personal Data” includes information such as government identifiers, financial account information, precise geolocation, biometric identifiers, health data, and information concerning children. “Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, and deletion.

3. Categories of Personal Data Collected

Depending on the context of your interaction with the Services, IPGen may collect and process the following categories of Personal Data: (a) Identifiers – name, business contact information, email address, username, IP address, device identifiers; (b) Account and Authentication Data – credentials, access logs, security tokens; (c) Commercial Information – subscription details, transaction history, billing and payment information; (d) Professional Information – employer, role, institutional affiliation; (e) Technical and Usage Data – log files, browser type, operating system, session activity, API usage metrics; (f) Customer Content – information and documents submitted through the Services; (g) Communications – support requests, emails, chat records; (h) Sensitive Personal Data (where provided) – limited to what is necessary for the Services and subject to heightened protections.

4. Sources of Personal Data

IPGen collects Personal Data from: (a) You directly, when you create an account, use the Services, communicate with us, or submit information; (b) Your organization or institution, when it provisions access on your behalf; (c) Automatically, through cookies, logs, and similar technologies; (d) Service providers and subprocessors supporting the Services; (e) Publicly available sources, where permitted by law.

5. AI Systems and Use of Personal Data

IPGen operates artificial intelligence and machine learning systems as part of the Services. Personal Data may be processed to: (a) Provide and operate the Services; (b) Generate Outputs at your direction; (c) Secure, monitor, and improve system performance; (d) Comply with legal obligations. IPGen does not use Customer Personal Data, Customer Content, or Confidential Information to train or fine-tune general-purpose artificial intelligence models unless expressly authorized through a separate written agreement or explicit opt-in. IPGen does not engage in automated decision-making that produces legal or similarly significant effects on individuals without appropriate safeguards and lawful basis.

Outputs generated by AI systems may include or reflect Personal Data provided by users and are not independently verified by IPGen. IPGen does not guarantee the accuracy, completeness, or appropriateness of Outputs or the data contained within them. Users are solely responsible for ensuring that any Personal Data included in inputs or Outputs complies with applicable law.

6. Purposes of Processing

IPGen processes Personal Data for the following purposes: (a) To provide, operate, maintain, and secure the Services; (b) To create and administer user accounts and authenticate access; (c) To process transactions, subscriptions, and payments; (d) To generate Outputs and perform services requested by customers; (e) To provide customer support, respond to inquiries, and manage communications; (f) To monitor, analyze, and improve performance, reliability, and functionality of the Services; (g) To detect, prevent, and investigate fraud, security incidents, and abuse; (h) To comply with legal, regulatory, and contractual obligations; (i) To enforce the Terms of Use and other agreements; (j) To conduct research and development using aggregated and de-identified data; (k) To carry out corporate transactions such as mergers, acquisitions, or restructurings. IPGen relies on data provided by users and does not guarantee the accuracy, completeness, or reliability of such data.

7. Legal Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, IPGen relies on one or more of the following legal bases: (a) Performance of a Contract – processing necessary to provide the Services under the Terms and applicable agreements; (b) Legitimate Interests – including operating, securing, and improving the Services, preventing fraud, and protecting IPGen’s rights, balanced against individual rights; (c) Compliance with Legal Obligations – including tax, accounting, and regulatory requirements; (d) Consent – where required by law, such as for certain cookies or marketing communications; (e) Vital Interests – where processing is necessary to protect the life or safety of individuals.

8. Use of Personal Data

IPGen uses Personal Data to: (a) Deliver and personalize the Services; (b) Administer subscriptions and billing; (c) Communicate with users regarding updates, security notices, and support; (d) Conduct analytics and service optimization; (e) Enforce acceptable use and investigate violations; (f) Protect the security and integrity of systems and data;

(g) Comply with lawful requests from authorities; (h) Support internal business operations and corporate governance. IPGen does not sell Personal Data and does not share Personal Data for cross-context behavioral advertising. Use of AI-generated Outputs may involve inherent limitations and risks. IPGen does not independently validate or verify the content of Outputs or the data contained within them.

9. Data Retention

IPGen retains Personal Data only for as long as necessary to fulfill the purposes described in this Policy, including: (a) The duration of the contractual relationship; (b) As required to comply with legal, accounting, or regulatory obligations; (c) To resolve disputes and enforce agreements; (d) To maintain security logs and audit trails; (e) To support backup and disaster recovery. Retention periods may vary based on data category, legal requirements, and business needs. When Personal Data is no longer required, it is securely deleted or irreversibly anonymized in accordance with IPGen’s data retention and destruction policies.

10. Disclosure of Personal Data

IPGen may disclose Personal Data in the following circumstances and to the following categories of recipients: (a) Service Providers and Subprocessors – to third parties that perform services on our behalf, such as cloud hosting, data storage, payment processing, security monitoring, analytics, customer support, and professional services, under contractual obligations of confidentiality and data protection; (b) Affiliates and Corporate Transactions – to affiliates and in connection with mergers, acquisitions, financing, due diligence, reorganization, sale of assets, or similar corporate transactions, subject to appropriate confidentiality and security measures; (c) Legal and Regulatory Authorities – where required by law, court order, subpoena, or governmental request, or where necessary to protect the rights, property, or safety of IPGen, our customers, or others; (d) With Your Instructions or Consent – to third parties at your direction or with your explicit consent. IPGen does not sell Personal Data and does not share Personal Data for cross-context behavioral advertising within the meaning of the CCPA/CPRA.

11. Service Providers and Subprocessors

IPGen engages third-party service providers and subprocessors to support the operation of the Services. Such entities may process Personal Data solely for the purposes described in this Policy and in accordance with written agreements that require: (a) Processing only on documented instructions from IPGen; (b) Implementation of appropriate technical and organizational security measures; (c) Confidentiality and data protection obligations; (d) Assistance with data subject rights requests and regulatory compliance; (e) Audit and oversight rights, where required by law or contract. A current list of key subprocessors may be made available upon request, subject to confidentiality.

12. International Data Transfers

Personal Data may be transferred to, stored in, and processed in countries other than the country in which you reside, including the United States and other jurisdictions where IPGen or its service providers operate. Where required by applicable law, IPGen implements appropriate safeguards for international transfers, including: (a) Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner’s Office; (b) Data Transfer Impact Assessments; (c) Additional technical and organizational measures to protect Personal Data. IPGen does not guarantee compliance with jurisdiction-specific data localization requirements unless expressly agreed in writing.

13. Individual Rights Under Data Protection Laws

Depending on your jurisdiction, you may have the following rights with respect to your Personal Data: (a) Right of Access – to obtain confirmation as to whether we process your Personal Data and to receive a copy; (b) Right of Rectification – to request correction of inaccurate or incomplete Personal Data; (c) Right of Erasure – to request deletion of Personal Data, subject to legal exceptions; (d) Right to Restriction of Processing – to request that processing be limited; (e) Right to Data Portability – to receive Personal Data in a structured, commonly used, and machine-readable format; (f) Right to Object – to object to certain processing based on legitimate interests or for direct marketing;

(g) Right to Withdraw Consent – where processing is based on consent, at any time without affecting prior lawfulness. Requests may be submitted by contacting privacy@ipgen.io. IPGen will respond in accordance with applicable legal timeframes and may require verification of identity.

14. California and U.S. State Privacy Rights

Residents of California and other U.S. states with comprehensive privacy laws may have additional rights, including: (a) The right to know what Personal Data is collected, used, disclosed, and retained; (b) The right to delete Personal Data, subject to exceptions; (c) The right to correct inaccurate Personal Data; (d) The right to opt out of the “sale” or “sharing” of Personal Data (which IPGen does not engage in); (e) The right to limit use of Sensitive Personal Data; (f) The right to non-discrimination for exercising privacy rights. IPGen honors Global Privacy Control (“GPC”) signals and similar browser-based opt-out mechanisms where required by law.

15. Children’s Privacy

The Services are not directed to children under the age of 13, and IPGen does not knowingly collect Personal Data from children. If we become aware that Personal Data of a child has been collected without appropriate consent, we will take steps to delete such information.

16. Information Security Program

IPGen maintains a comprehensive information security program designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. This program includes administrative, technical, and physical safeguards consistent with industry standards and frameworks, including SOC 2 Type II and ISO 27001. Security measures include, without limitation: (a) Role-based access controls and multi-factor authentication; (b) Encryption of data in transit and at rest using industry-standard cryptography; (c) Network segmentation, intrusion detection, and continuous monitoring; (d) Vulnerability management, penetration testing, and security audits; (e) Secure development practices and code review; (f) Incident response planning and tabletop exercises; (g) Business continuity and disaster recovery planning.

17. Incident Response and Breach Notification

IPGen maintains documented incident response procedures designed to promptly identify, contain, investigate, remediate, and recover from security incidents. In the event of a confirmed Personal Data breach affecting Customer Personal Data, IPGen will: (a) Notify the affected customer without undue delay and, where required by law, within applicable statutory timeframes; (b) Provide information regarding the nature of the incident, categories and approximate number of individuals and records affected, and measures taken or proposed to address the incident; (c) Cooperate with customers and, where applicable, regulatory authorities in meeting notification and remediation obligations. Nothing in this Policy shall be construed as an admission of fault or liability.

18. Risk Management and Assessments

IPGen conducts periodic risk assessments and, where required by law, data protection impact assessments (DPIAs) and transfer impact assessments (TIAs) to evaluate risks associated with processing activities, including use of AI systems and international data transfers. Where high risks to individuals are identified, IPGen implements appropriate technical and organizational measures to mitigate such risks.

19. Data Retention and Deletion

IPGen retains Personal Data only for as long as necessary to fulfill the purposes described in this Policy, including to: (a) Provide and maintain the Services; (b) Comply with legal, regulatory, tax, and accounting obligations; (c) Resolve disputes and enforce agreements; (d) Maintain security, audit, and compliance records; (e) Support backup, disaster recovery, and business continuity. Retention periods vary based on the category of data, the context of processing, and applicable legal requirements. When Personal Data is no longer required, it is securely deleted, anonymized, or aggregated in accordance with IPGen’s data retention and destruction policies and applicable law.

20. Data Minimization and Purpose Limitation

IPGen collects and processes only the Personal Data that is reasonably necessary and proportionate to achieve the purposes described in this Policy. Personal Data is not processed for purposes incompatible with those purposes unless required or permitted by law, or with appropriate notice and lawful basis.

21. Changes to This Privacy Policy

IPGen may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, or business practices. Material changes will be posted on the Services or otherwise communicated as required by law. The “Effective Date” below indicates when the Policy was last revised. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance, to the extent permitted by law.

22. Contact Information

If you have any questions, requests, or concerns regarding this Privacy Policy or IPGen’s data protection practices, you may contact: International Products Generated, Inc. Attn: Privacy Office 4709 Harford Road, #23 Baltimore, Maryland 21214 Email: info@ipgen.io

23. Complaints and Supervisory Authorities

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with a data protection authority, you have the right to lodge a complaint with your local supervisory authority regarding IPGen’s processing of your Personal Data. We encourage you to contact us first so we can address your concerns directly.

24. Effective Date

This Privacy Policy is effective as of the “Last Updated/Modified” date posted on the IPGen website and supersedes all prior versions.