PRIVACY POLICY

Last updated: October 15, 2026

HillGenius Inc., together with its subsidiaries and affiliates ("HillGenius," "we," "us," or "our"), provides access to a legislative-intelligence platform and associated transcription, research, drafting, and monitoring services for government affairs professionals, including through our web and mobile applications (the "Service"). We may collect certain information from or about you in connection with the Service, our websites, and our marketing and business activities. By accessing the Service, using our websites, or otherwise providing us with information, you acknowledge and agree that HillGenius may collect, use, and disclose your personal information ("Personal Information," meaning information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household) as outlined in this Privacy Policy. In this Privacy Policy, "Customer Content" means the text queries, prompts, writing samples, documents, and other content that you or your Authorized Users submit to the Service, and the responses, drafts, and other output generated by the Service for you or your Authorized Users. Customer Content does not include transcripts of public hearings and government events or other content that we make generally available to users of the Service. This Privacy Policy is incorporated by reference into the HillGenius Terms of Service ("Terms of Service"). Capitalized terms not defined in this Policy have the meanings given in the Terms of Service.

We may update this Privacy Policy from time to time as our Service evolves and to comply with new and changing privacy laws, and we will notify you of such changes in compliance with applicable laws and our agreements with you. This Privacy Policy applies to Personal Information we collect and process in connection with the Service, our websites, and our business activities. Where we process Personal Information on behalf of our business customers ("Customers") as a data processor or service provider, that processing is governed by the Data Processing Addendum ("DPA") between HillGenius and the Customer; the commitments in this Privacy Policy supplement and do not limit the DPA. HillGenius does not control how Customers use information that HillGenius processes on their behalf, and individuals whose Personal Information is submitted to the Service through a Customer account should consult with the applicable Customer regarding its use of such information.

California Notice at Collection / State Privacy Rights Notice: See the State Privacy Rights Notice (Section 10) for important information about your rights under applicable US state privacy laws.

1. Personal Information We Collect

1.1 Information you provide to us. Personal Information you may provide through the Service or otherwise includes:

• Account and contact data, such as your first and last name, business email address, employer name, job title, and account credentials, when you register for or administer a Service account.
• Payment and transaction data, processed directly by our payment processor. We receive limited transaction confirmation data; your full payment card details are collected and stored by Stripe, not by HillGenius.
• Customer Content, including text queries, legislative research inputs, and other content that you or your Authorized Users submit to AI features of the Service.
• Transcript requests and hearing URL submissions, including the URLs of pages for public hearings or government events that you submit to request a transcript and any associated event details. HillGenius uses these URLs to locate and process the publicly available audio and video.
• Monitoring subjects and client-name alert configurations, including the client names, subject names, keywords, and topic subscriptions you configure in the Services to receive targeted legislative alerts and updates.
• Writing samples, such as prior memos, briefings, or other documents that you upload to drafting features of the Service to establish a drafting voice and style.
• Communications data, based on exchanges with our sales and support teams, including emails and messages you send us and in-product help, setup, and support chats.
• Feedback and suggestions, if you provide ideas, recommendations, or other input about the Service.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

1.2 Information collected automatically. When you use the Service, our service providers and we automatically collect:

• Log data, such as your IP address, browser type and version, operating system, referring URLs, and access timestamps.
• Usage data, such as the features you use, actions you take, and time spent on pages or screens, which is associated with your account identifier but does not include the content of your queries, chats, drafts, or documents.
• Device data, such as device type, operating system version, and browser configuration.
• Approximate location, inferred from your IP address and used only to operate security features, such as notifying you of a sign-in from a new location.

1.3 Information from other sources. We may receive limited Personal Information from:

• Your organization, such as when a Customer administrator adds you as an Authorized User or provides your contact details.
• Service providers, such as our hosting and infrastructure providers, in connection with security, fraud prevention, and service delivery.
• Public sources, such as publicly available congressional and legislative records, that the Service organizes and surfaces.

1.4 Data about others. If you provide Personal Information about colleagues or third parties (for example, when configuring client-name alerts in the Service or adding Authorized Users), please ensure you have authority to share that information and, where applicable, that you have informed those individuals.

1.5 Congressional participants and public officials. The Service processes publicly available information about members of Congress, committee witnesses, and other public-record participants in congressional and other public proceedings. This includes: (a) audio and video of congressional hearings and other public hearings and government events, retrieved from official websites using URLs submitted by Authorized Users, which is processed using automated speech recognition and AI to produce transcripts with speaker attribution; (b) transcript text linked to timestamped video moments for verification; (c) congressional bills, hearing transcripts, and members' publicly available statements and social media posts, which AI features of the Service draw on to answer natural-language queries; and (d) publicly available information on all Members of Congress, committees, and bills compiled in the Service. In all cases, HillGenius processes only information that forms part of the public congressional record or that public officials have made publicly available and does not use that information to build profiles of private individuals. Public officials and congressional participants whose information is processed by the Service are not HillGenius account holders or Authorized Users.

2. Tracking Technologies and AI Tools

2.1 Cookies and similar technologies. We and our service providers use the following cookies and similar technologies on our websites and in the Service: (a) strictly necessary cookies for sign-in, session management, and security; (b) a first-party attribution cookie that records how you arrived at our website; (c) analytics technologies that measure use of our websites and the Service, as described in Section 3.3; and (d) on our marketing pages only, the LinkedIn Insight Tag described in Section 2.4. We do not use advertising technologies within the logged-in Service. You can manage cookies through your browser settings and as described in Section 2.5.

2.2 AI tools and input processing. The AI features of the Service use third-party artificial-intelligence providers to process the inputs you submit and generate responses, as described in Section 4.

2.3 Public proceedings content processing. The Service processes publicly available audio and video recordings of public hearings and government events to generate transcripts with speaker attribution. This processing relates to public officials, witnesses, and other participants in public proceedings and does not constitute collection of voice biometric data from HillGenius users or Authorized Users.

2.4 Limited use of advertising technology. We do not use advertising networks, retargeting pixels, or interest-based advertising technologies within the logged-in Service, and we do not share Personal Information with advertising partners for use within the Service. On our marketing pages, we use the LinkedIn Insight Tag to measure the effectiveness of our advertising campaigns and to show our ads on LinkedIn to visitors of those pages. LinkedIn processes information collected through the Insight Tag under its own privacy policy. This use may constitute "sharing" for cross-context behavioral advertising or "targeted advertising" under State Privacy Laws (as defined in Section 5.7), and you may opt out as described in Section 2.5.

2.5 Your controls. We honor Global Privacy Control ("GPC") opt-out preference signals as valid requests to opt out of any sale or sharing of Personal Information, as required by applicable law. When your browser sends a GPC signal, the LinkedIn Insight Tag does not load. You may also opt out of such sharing by emailing privacy@hillgenius.com with the subject line "Do Not Sell or Share My Personal Information."

3. How We Use Your Personal Information

We may use your Personal Information for the following purposes or as otherwise described at the time of collection.

3.1 Service delivery and operations. We use Personal Information to:

• provide, operate, and maintain the Service, including generating transcripts, AI-generated responses and drafts, alerts, and other content;
• establish, maintain, and administer your account;
• process and confirm payments through our payment processor;
• send you service-related communications, security alerts, and account notices; and
• provide customer support and respond to your inquiries and feedback.

3.2 Security, fraud prevention, and compliance. We use Personal Information to:

• detect, investigate, and prevent unauthorized access, security incidents, fraud, and other misuse of the Service, including by using approximate IP-based location for security features such as new sign-in notices;
• enforce our Terms of Service and other agreements; and
• comply with applicable laws, respond to lawful requests, and cooperate with legal proceedings.

3.3 Service improvement and analytics. We use technical and usage data, which is associated with account identifiers but does not include the content of your queries, chats, drafts, or documents or the responses generated by the Service, to analyze Service performance, understand feature usage, diagnose technical issues, and develop improvements.

3.4 Personalization and quality review. Depending on the settings selected by a Customer's account administrator, we may use information about how Authorized Users interact with the Service to personalize the Service and generate recommendations, and authorized personnel may review a limited sample of interactions with certain features to improve quality and safety.

3.5 Marketing communications. We may send you information about the Service, new features, and related offerings. You may opt out of marketing emails at any time by clicking the unsubscribe link in any email or by contacting us as described in Section 12. Opting out of marketing communications does not affect service notices.

3.6 Aggregated and de-identified data. We may create aggregated, de-identified, or anonymized data derived from Personal Information and use and share it for lawful business purposes, including analyzing and improving the Service. We will not attempt to re-identify such data except to verify that our de-identification processes comply with applicable law.

3.7 No automated decision-making. We do not use Personal Information for automated decision-making that produces legal effects concerning you or similarly significant effects on you, as those terms are understood under applicable US state privacy laws. We do not create or use automated profiles of individuals to make such decisions, and we do not engage in profiling of individuals in furtherance of such automated decision-making.

4. AI Features and No Model Training

4.1 AI providers as service providers. The Service uses third-party artificial-intelligence providers identified in the Sub-processor list described in Section 5.2 as Sub-processors to process inputs and generate responses. These providers are permitted to use the content you submit solely to provide services to HillGenius and are contractually prohibited from using your inputs or the responses generated to train, fine-tune, or otherwise improve their own foundation or large language models, and may retain the content you submit only for a limited period as necessary to process the request, to detect and prevent abuse, or to comply with applicable law.

4.2 No model training by HillGenius. HillGenius does not use Customer Content to train, fine-tune, or otherwise improve the foundation or large language models of HillGenius or of any third party, regardless of any account settings.

4.3 Beta features. Certain AI features, including the AI Analyst research assistant, are currently offered as Beta Features. The same data-protection commitments in this Policy apply.

5. How We Share Your Personal Information

5.1 Service providers and Sub-processors. We share Personal Information with vendors and Sub-processors that perform services on our behalf, including:

• Hosting and infrastructure: cloud hosting, database, application server, backup storage, and network security providers, which operate on enterprise cloud infrastructure;
• Payment processing: currently Stripe, which collects and processes payment card information directly and under its own privacy policy;
• Communications, analytics, and operations: providers of messaging, customer relationship management, analytics, and monitoring services;
• Artificial-intelligence and document processing: AI model providers and document text-extraction providers, subject to the commitments in Section 4; and
• Additional providers we may engage from time to time, as reflected in the Sub-processor list described in Section 5.2.

These providers are permitted to use Personal Information only to provide services to HillGenius and are bound by contractual data-protection obligations.

5.1.1 Customer Content created or stored by an Authorized User in the Service is accessible only to that Authorized User by default. It becomes accessible to other Authorized Users within the same Customer's organization only when the creating user shares it through the sharing settings of the Service or as configured by the Customer's account administrator. HillGenius does not share one Customer's data with any other Customer's organization.

5.2 Sub-processor list. A current list of Sub-processors that process Customer Data on HillGenius's behalf is available on our website at https://www.hillgenius.com/subprocessors.

5.3 Professional advisors. We may share Personal Information with our lawyers, accountants, auditors, and other professional advisors in connection with the professional services they provide to us, subject to appropriate confidentiality obligations.

5.4 Legal compliance and safety. We may disclose Personal Information where necessary to comply with law, respond to lawful requests from government or regulatory authorities, enforce our agreements, or protect the rights, safety, and property of HillGenius, our Customers, or others.

5.5 Business transfers. We may disclose Personal Information in connection with an actual or prospective merger, acquisition, financing, or sale of all or part of our business or assets, including in insolvency or bankruptcy proceedings.

5.6 Aggregated and de-identified information. We may create and share aggregated or de-identified information that cannot reasonably be used to identify you.

5.7 No sale; limited sharing for advertising. We do not sell Personal Information for monetary consideration. Except for the LinkedIn Insight Tag on our marketing pages described in Section 2.4, we do not share Personal Information with third parties for cross-context behavioral advertising or targeted advertising purposes, as those terms are defined under applicable State Privacy Laws (meaning applicable US state laws that grant privacy rights to their residents, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and similar laws enacted or effective in other US states).

6. Data Retention

6.1 Retention period. We retain Personal Information for as long as your account is active and as needed to provide the Service, and thereafter as necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and protect our legitimate interests. Certain features of the Service have specific retention periods, or retention periods selected by the Customer's account administrator, as described in the Documentation.

6.2 Retention criteria and deletion. To determine the appropriate retention period, we consider the nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal requirements. When we no longer need Personal Information, we will delete, anonymize, or isolate it from further processing. Residual copies created in the ordinary course of business-continuity and disaster-recovery operations may be retained for a limited period after deletion from active systems; such copies are not used for any purpose other than system recovery. We delete or return content submitted to the Service following account termination within the timelines set out in our agreements with the Customer. This does not apply to aggregated or de-identified information, content that we make generally available to users of the Service, or information we must retain to comply with applicable law.

7. Data Security.

We maintain robust administrative, technical, and organizational safeguards designed to protect Personal Information against loss, misuse, unauthorized access, disclosure, alteration, or destruction. Our infrastructure operates on enterprise cloud providers, and we apply industry-appropriate access controls, encryption in transit, and, where available, encryption at rest. We continuously evaluate and enhance our security practices to address evolving threats. In the event of a personal data breach that requires notification under applicable law, we will notify affected parties without undue delay and in any event within the timeframes required by applicable State Privacy Laws.

8. Children's Privacy.

The Service is intended for professional users who are at least 18 years old. We do not knowingly collect Personal Information from individuals under 18. In particular, we do not knowingly collect Personal Information from children under 13 years of age in violation of the Children's Online Privacy Protection Act ("COPPA"). If we learn that we have collected Personal Information through the Service from a child without the consent of the child's parent or guardian as required by law, we will comply with applicable legal requirements to delete the information. If you are a parent or guardian who believes we have collected Personal Information from a child in your care, please contact us using the details in Section 12.

9. Third-Party Links and Services.

The Service may include links to websites, mobile applications, and other online services operated by third parties, including timestamp links and hearing and event citations that direct you to official pages and video sources. These links are provided for your convenience and reference. While we select our integration partners with care, each third-party service operates under its own privacy policy and practices, which are independent of this Privacy Policy. We encourage you to review the privacy policies of any third-party services you visit through the Service.

10. State Privacy Rights Notice.

Except as otherwise provided, this Section applies to residents of US states that have enacted State Privacy Laws applicable to HillGenius granting the rights described below.

Your privacy rights. Depending on your state of residence, and subject to applicable exceptions and limitations, you may have some or all of the following rights:

• Access / Know: confirm whether we process your Personal Information and obtain a copy;
• Correction: request correction of inaccurate Personal Information we hold about you;
• Deletion: request deletion of Personal Information we have collected from you;
• Portability: receive a portable copy of your Personal Information in a readily usable format;
• Opt-out of sale or sharing: opt out of the sale of Personal Information or sharing for targeted advertising (we do not sell Personal Information; to opt out of the limited sharing described in Section 2.4, see Section 2.5);
• Opt-out of profiling: opt out of profiling that produces legal or similarly significant effects (we do not engage in such profiling); and
• Non-discrimination: we will not discriminate against you for exercising any of these rights.
• Limit use of sensitive Personal Information: request that we limit the use and disclosure of your sensitive personal information to purposes permitted under applicable law (we do not use sensitive personal information beyond what is necessary to provide the Service; see "Sensitive Personal Information" below).

No sale; limited targeted advertising. We do not sell your Personal Information. We share it for cross-context behavioral advertising or targeted advertising only through the LinkedIn Insight Tag on our marketing pages, as described in Section 2.4. We honor GPC opt-out preference signals as valid requests to opt out of any sale or sharing of Personal Information, as required by applicable law.

How to exercise your rights. Submit a privacy rights request by contacting us at privacy@hillgenius.com. We may need to verify your identity before processing your request. Verification may include matching information you provide with information we already maintain about you; for requests submitted through a non-authenticated channel, we may ask you to confirm your account email address and provide additional identifying details. We will respond within the period required by applicable law (generally 45 days, extendable by an additional 45 days with prior notice). You may designate an authorized agent to submit requests on your behalf by providing us with written authorization signed by you, a valid power of attorney, or proof that the agent is registered with the California Secretary of State; we may independently verify your identity in addition to verifying your agent's authority.

Right to appeal. If we deny your request in whole or in part, we will provide a written explanation. You may appeal our decision by contacting us at privacy@hillgenius.com with the subject line "Privacy Request Appeal." Where applicable, you may also contact your state attorney general.

Requests concerning content submitted through a Customer account. If your request relates to Personal Information we process on behalf of a Customer (as described in the introduction to this Privacy Policy), we will refer the request to that Customer, as we are not in a position to fulfill it independently.

Information practices in the past 12 months. The following table describes our information practices currently and during the past 12 months. We do not sell Personal Information, and we share it for targeted advertising only as described in Section 2.4.

Sensitive Personal Information. We do not intentionally collect categories of Personal Information that qualify as sensitive personal information under State Privacy Laws (such as government-issued ID numbers, financial account credentials, precise geolocation, biometric identifiers, health data, or information about racial or ethnic origin, religious beliefs, or sexual orientation) in the course of providing the Service. If you believe Customer Content you have submitted contains sensitive personal information, please contact us.

Sources and purposes. We collect all categories of Personal Information listed above from the sources described in Section 1 and use them for the business and commercial purposes described in Section 3.

Retention. The criteria we use to determine retention periods are described in Section 6.

De-identification. We do not attempt to re-identify de-identified or anonymized information derived from Personal Information, except to verify that our de-identification processes comply with applicable law.

California-specific disclosures.

• Shine the Light. Under California Civil Code Section 1798.83, California residents may request information about third parties to whom we have disclosed Personal Information for their own direct marketing purposes in the preceding calendar year. HillGenius does not make such disclosures. To submit a precautionary request, contact us at privacy@hillgenius.com with the subject line "Shine the Light Request," and include your name, mailing address, and a statement certifying California residency.
• Consumers under 16. We do not have actual knowledge that we collect, sell, or share the Personal Information of consumers under 16 years of age.

Additional state disclosures.

• Nevada. Nevada residents may opt out of the sale of certain Personal Information for monetary consideration. We do not sell Personal Information. Nevada residents who wish to submit a precautionary opt-out may contact us at privacy@hillgenius.com.
• Texas. We do not sell sensitive Personal Information as defined by the Texas Data Privacy and Security Act.

11. Changes to This Policy.

We may update this Privacy Policy from time to time. For material changes, we will provide advance written notice as required by applicable law, for example, by email or through the Service, and the updated Policy will take effect on the date stated in that notice. Your continued use of the Service after that date constitutes acknowledgment of the updated Policy. Where applicable law requires consent before material changes to our data practices, we will seek that consent.

12. How to Contact Us

HillGenius Inc., a Delaware corporation, 1100 15th St NW, 4th Floor, Washington, DC 20005.

Privacy questions and privacy requests may be sent to privacy@hillgenius.com.

For requests submitted under the State Privacy Rights Notice, see Section 10. This Privacy Policy is available in alternative formats upon request; please contact us at the email address above.