CARDSIGHT AI™ PRIVACY POLICY

Last Updated: December 1st, 2025

  1. INTRODUCTION AND COMPANY INFORMATION

We at CardSight AI, Inc. (“CardSight AI,” “we,” “us,” or “our”) respect your privacy and are committed to protecting it through our compliance with this CardSight AI Privacy Policy (this “Policy”). This Policy describes the types of information we may collect from you or that you may provide to us when you (i) visit our website at https://cardsight.ai and any successor, subpage, or subdomain thereof (collectively, our “Website”), and (ii) access and use our proprietary APIs, related software solutions, and associated technical and other support services (our “Software”, and collectively with our Website, our “Services”) and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This Policy applies to (i) any information that we collect on the Website or otherwise in connection with your use of the Website, including any information in any forms or messages submitted by you to us through our Website or using the contact information on our Website; (ii) any information collected when you interact with email or other electronic messages you receive from us, and (iii) any information that we collect in connection with your use of our Software. This Policy does not apply to any other information we collect by any other means.

If you or your organization has contracted with us to access and use our Software under a written agreement other than our standard CardSight AI™ Terms of Service (the “Terms of Service”), this Policy does not apply to any information collected or processed by us in connection with your or your organization’s use of such Software. In such cases, you will need to refer to our contract with you or your organization for information about our policies and practices for collecting and processing information obtained in connection with your or your organization’s use of such Software.

Please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with our policies and practices, please do not use our Services.

  1. INFORMATION COLLECTION

    1. Types of Information We Collect

We may collect several types of information from and about users of our Services. This information may include information by which users may be personally identified or other information about a user to the extent maintained in personally-identifiable form (collectively, “Personal Information”). Specifically, we (or our third-party service providers acting on our behalf) may collect the following categories of Personal Information from you:

  • Personal identifiers and contact information, such as your name, email address, telephone number (including mobile telephone number) and the IP address or mobile device ID of the computer or device used to access and use our Services (“Identifiers”).

  • Payment information, such as your payment card number, security codes, zip codes (for verification purposes), and other financial information used to process transactions on our Services. Please note that the third-party payment processor(s) we have engaged to process payments through our Services collect this information directly from you and process this information on our behalf, and we do not at any time directly store or have access to any payment information, other than certain limited subsets of information we retain for the purposes of maintaining a record of your purchase.

  • The name and contact information of your company or organization.

  • Your or your company or organization’s country or region.

  • The Technical Information described in the section below titled “Use of Cookies and Tracking Technologies”.

  • Information related to Internet or other similar network activity, including browsing history, search history, and information on your interaction with our Services (“Internet Activity”).

  • Any other information (including Personal Information) you choose to provide to us, such as in any forms or messages submitted by you to us through our Website or using the contact information provided on our Website, or any Personal Information that you chose to upload to or through our Software or otherwise provide to us in connection with our provision of our Services.

    1. Methods of Collection

Generally, we collect Personal Information directly from you when you provide it or submit it to us directly, such as in connection with:

  • Registering for a subscription to our Software and creating an account on our Services.
  • Filling out forms on our website.
  • Corresponding with us by email, phone, or other methods.
  • Subscribing to our newsletters or other marketing or promotional communications about us or our Services.
  • Requesting customer support or contacting us to report a problem with our Services.
  • Responding to a voluntary survey you have agreed to complete.
  • Entering into a sweepstakes, contest, giveaway, or other promotion related to our Services.
  • Otherwise using or interacting with our Services.

We or our third-party service providers acting on our behalf may also collect certain information automatically when you visit our website, as described in the section below titled “Use of Cookies and Tracking Technologies”.

  1. Children’s Information

Our Services are not directed to or otherwise intended for children under 18 years of age, and no one under the age of 18 may provide any information to us on or using our Services. We do not knowingly collect Personal Information from children under the age of 18. If you are under 18 years of age, do not use our Services or provide any information about yourself to us, including your name, address, telephone number, email address, IP address or mobile device ID, or any screen name or username you may use. If we learn we have collected or received Personal Information from a child under 13 without verification of parental consent, we will delete that information.

If you believe we might have any information from or about a child under 13, please contact us immediately at [email protected].

  1. USE AND PURPOSE OF INFORMATION COLLECTION

    1. Purposes of Collection

We use the Personal Information we collect about you or that you provide to us for the following purposes:

Our Operations:

  • Providing and maintaining our Services.
  • Processing and completing payment transactions through our Services.
  • Authenticating or otherwise verifying your identity in connection with your requests and inquiries to us.
  • Managing your account and preferences.
  • Providing you with support related to your use of our Services and otherwise responding to your inquiries and requests.
  • Investigating and addressing your concerns with our Services and improving our responses to support inquiries.
  • Improving our Services and developing new features.
  • Analyzing usage patterns and trends.
  • Detecting, preventing, and addressing technical issues.
  • Protecting the safety, security, and integrity of our Services, databases, other technology assets, and our business.

Our Marketing and Promotional Activities:

  • Registering you for sweepstakes, contests, giveaways, or other promotions.
  • Updating and maintaining email or mailing lists (such as our email lists to receive newsletters or alerts by email).
  • Sending you newsletters, promotions, and updates about our Services.
  • Communicating with you about changes to our Services or notifying you about new features, products, or services.
  • Providing personalized content and recommendations.
  • Developing and conducting surveys and collecting feedback.

Our Other Legally-Protected Activities:

  • Responding to lawful requests for information through court orders, subpoenas, warrants, and other legal processes.
  • Enforcing any contracts between you and us, including for billing and collection, or for the establishment, exercise, or defense of legal claims.
  • Evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets or equity, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred.
  • Fulfilling any other purpose for which you provide the information.
  • Serving any other purpose that we describe when you provide the information and for any other purpose with your consent.

3.2 Use and Disclosure of Pseudonymized, Aggregated, or De-Identified Data

We may pseudonymize some Personal Information of users so that it can no longer be attributed to a particular, identifiable user without the use of other separately maintained information, or we may convert or combine some Personal Information of users into de-identified or aggregated data that does not disclose any of the Personal Information of any individual user. As an example, we may pseudonymize, de-identify, or aggregate information provided by or collected about you and other visitors to our Website or users of our Software to generate aggregate trends or insights about the behavior of visitors to our Website or users of our Software generally that may be shared (including for commercial purposes) with third parties. You understand and agree that we may use and disclose to third parties any such pseudonymized, de-identified, or aggregated data for any lawful purpose.

3.3 Use of Google Analytics

We may use Google Analytics to track and analyze certain traffic and usage statistics regarding the use of our Services, such as the number of visitors to our Services, how visitors are navigating to our Services, visitors’ general geographic region information, how long individuals are visiting our Services, and information about the equipment individuals are using to access our Services (e.g., browser version and operating system). Google Analytics may use a Google Analytics cookie as part of this service, and we may share certain Personal Information with Google Analytics (such as an IP address) as part of this service. We use this traffic and usage information to make improvements to our Services and our own marketing and promotional efforts.

For more information, please review the following:

  1. DISCLOSURE OF YOUR INFORMATION

    1. Disclosures to our Affiliates and Service Providers

We may disclose your Personal Information to our affiliates or to any contractors or other third-party service providers who need to know such information (or such contractors or service providers may collect Personal Information directly from you while you use our Services) to perform services on our behalf that support our hosting, maintenance, operation, and promotion of our Services and our permitted uses of Personal Information under this Policy, including:

  • Payment Processing: We may use Stripe or a similar provider of payment processing services to process payments and financial transactions on our Website.

  • Email Services: We may use third-party email service providers to send email communications to you.

  • Analytics: We may use analytics providers to help us understand how users interact with our Services (such as Google Analytics, as described in the section above titled “Use of Google Analytics).

  • Customer Support and Customer Relationship Management: We may use third-party customer support and customer relationship management services.

  • Hosting and Infrastructure: We may use cloud service providers to support our software hosting and infrastructure needs.

    1. Other Circumstances for Disclosure

We may also disclose your Personal Information:

  • To comply with any court order, law, or legal process, including responding to any government or regulatory request or audit or to meet national security and law enforcement requirements.
  • To enforce our Terms of Service or other agreements between us and you.
  • To protect the rights, property, or safety of CardSight AI, our users, or others.
  • To a buyer or other successor to our business in connection with a merger, acquisition, reorganization, sale of equity or assets, or a similar corporate transaction, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, and in connection with any due diligence review with respect to any such proposed transaction.
  • To fulfill any other purpose disclosed when the information is provided, and for any other purpose with your consent.

We may disclose all forms of Personal Information for each of the purposes described above, including but not limited to your Identifiers, Internet Activity, and Technical Information.

  1. No Sales of Personal Information

We do not sell, and in the past 12 months we have not sold, any Personal Information to third parties.

  1. TRAFFIC, USAGE, AND COMPUTER/DEVICE INFORMATION; COOKIES AND TRACKING TECHNOLOGIES

    1. Use of Cookies and Tracking Technologies

As you navigate through and interact with our Services or interact with the emails or other electronic messages we send to you, we or our third-party service providers may automatically collect certain traffic data, usage information, and information about your computer equipment or mobile device, such as your browser and operating system, your wireless carrier, configuration data, clickstream analytics, and your actions and patterns when you use our Services (“Technical Information”). The technologies we use for this automatic data collection may include cookies that are stored on the browser of your computer or mobile device, small embedded electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) and similar tracking technologies or embedded code. We collect this information to manage our content and improve users’ use of our Services; to count and review the number of users of our Services and their usage patterns; to track key performance indicators such as pages accessed, frequency of access, and other statistical information related to our Services (for example, recording the popularity of certain content and verifying system and server integrity); to identify the portion of users who access our Services via different web browsers; to recognize if a user is a return user of our Services; to store information about a user’s visits; to remember a user’s preferences; and for similar purposes in connection with monitoring, operating, maintaining, and improving our Services.

  1. Cookie Management

Most web browsers allow you to control cookies and similar tracking technologies through their settings preferences. However, if you limit the ability of websites to set cookies, you may be unable to access certain parts or pages of our Services or certain parts or features of our Services may not function correctly. For more information about how to disable cookies and similar tracking technologies, please visit the Network Advertising Initiative’s Consumer Opt-Out page at https://thenai.org/opt-out/ and the Digital Advertising Alliance’s Consumer Assistance page at https://youradchoices.com/control

  1. “Do Not Track” Signals

Tracking involves the use of cookies, web beacons, or other embedded code or tracking technologies to collect, analyze, and store information on a user’s behavior over time on multiple sites, including information on the sites visited, products viewed, products purchased, and other online interactions. Some browsers incorporate a “Do Not Track” (“DNT”) feature that, when turned on, signals to websites that you do not want to be tracked. Because there is not yet a common understanding of how to interpret DNT signals, and because we do not (and do not allow third parties to) collect Personal Information about your online activities over time and across third-party sites for tracking purposes when you use our Services, we do not currently respond to DNT signals on our website. If your computer, browser, or mobile device sends a DNT signal to one or more of our Services, our Services will not treat you differently from users who do not send such signals.

  1. DATA RETENTION AND DELETION

We retain your Personal Information only for as long as necessary to fulfill the legitimate business purposes or uses stated in this Policy, unless a longer retention period is required or allowed by applicable law or to otherwise fulfill a legal requirement.

  1. SECURITY MEASURES

    1. Security Safeguards

We have implemented safeguards designed to protect your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure.

  1. Data Protection Procedures

While we strive to use commercially reasonable means to protect your Personal Information, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee the absolute security of your Personal Information.

We encourage you to help us protect your Personal Information by:

  • Using strong, unique passwords for your account.
  • Not sharing your account credentials with others.
  • Logging out of your account after using our Services on shared devices.
  • Promptly notifying us of any unauthorized access to or use of your account.

Any transmission of Personal Information through the Services is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained in our Services.

  1. USER RIGHTS AND CHOICES

    1. Your Privacy Rights

You can review, change, and request the deletion of certain portions of your Personal Information by sending us an email at [email protected] to request access to any Personal information that you have provided to us, or to request to correct or delete that Personal Information. Except as specifically described in the Section below titled “European Users: Your European Privacy Rights”, the following will apply with respect to each such request:

  • We will evaluate such requests on a case-by-case basis.

  • In certain cases we cannot delete your Personal Information. For example, we cannot continue to maintain your account and/or your subscriptions without retaining certain portions of your Personal Information, so a request to delete certain forms of Personal Information may require the deletion of your account and cessation of services to you.

  • We also may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

    1. California “Shine The Light” Disclosure

The California Civil Code permits California residents with whom we have an established business relationship to request that we provide a list of certain categories of Personal Information that we have disclosed to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, please send an e-mail to [email protected]. Please mention that you are making a “California Shine the Light” inquiry.

  1. Nevada Residents: Sale Opt-Out Rights

Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may submit a request to this designated address: [email protected]. Please mention that you are making a “Nevada Sale Opt-Out Right” request. However, please know we do not currently sell data triggering that statute's opt-out requirements.

  1. MARKETING COMMUNICATIONS

If you do not wish to have your Personal Information used by us to contact you for marketing purposes, you can opt out: (1) by sending us an email with your request to [email protected]; or (2) with respect to marketing communications by email, by clicking on the “Unsubscribe” or similar link in the most recent email you received from us and by following the prompts that appear. This opt-out does not apply to information provided as a result of a purchase, customer service or support service inquiry, or other informational or transactional communications (e.g., an order confirmation or response to a specific inquiry or request you have made to us).

  1. USERS OUTSIDE OF THE UNITED STATES

    1. Generally

Our Services are hosted in the United States and are provided from the United States. It is possible that certain information will be stored on servers in multiple other countries on the “cloud” or other similar distributed hosting platforms. If you are accessing our Services from any foreign jurisdiction with laws governing personal data collection, use, and disclosure that differ from United States laws, please note that by using our Servies and providing your Personal Information to us through our Services you are expressly and knowingly consenting to the transfer of your Personal Information from your home country to the United States (where laws may differ from the laws of your jurisdiction) and you are expressly and knowingly consenting to our use of such Personal Information in accordance with this Policy.

  1. European Users

If you are a user accessing and using our Services from one of the European Economic Area countries, Switzerland, or the United Kingdom (collectively, the “European Countries” and such users the “European Users”), please read this section carefully for more information about our collection, processing, and transfer of your Personal Information and your rights related to such activities.

A. Legal Basis for Processing

If you are a European User, we have the legal right to collect, process, use, and retain your Personal Information (“European Personal Information”) in the ways described in this Policy based on your consent, the need to use your European Personal Information to provide you with goods or services that you have requested, and/or our legitimate interests in furthering our existing relationship with you or preventing fraud. Accordingly, generally you have a contractual rather than a statutory obligation to provide such information. If you do not provide such information, you may be unable to use our Services and we may be unable to provide any products or services that you request.

B. Transfers of Your European Personal Information to the United States
** **
In connection with our collection and use of your European Personal Information, we may transfer all or certain portions of your European Personal Information to our servers in the United States or our third-party service providers in the United States. Please note that the governing bodies in your jurisdiction have determined that the laws of the United States do not provide adequate protection for your European Personal Information. Accordingly, we are transferring your European Personal Information from your country to the United States based on your explicit consent, because the transfer is necessary for the performance of a contract between you and us or the implementation of pre-contractual measures taken at your request, because the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and another natural or legal person (e.g., your organization), and/or because the transfer is necessary for the establishment, exercise, or defense or legal claims, and you acknowledge and agree that we may collect, use, and disclose your European Personal Information, both before and after such transfer, in accordance with this Policy.

C. Storage of Your European Personal Information

We securely store your European Personal Information in distributed locations in the United States using our own servers or the servers of reputable, third-party service providers such as our cloud-hosted infrastructure service provider and other cloud-based software service providers. We will keep such information for no longer than necessary. The length of time we retain your European Personal Information will depend on any legal obligations we have (such as tax recording purposes), the nature of any contracts we have in place with you, the existence of your consent, or our legitimate interests as a business.

D. Your European Privacy Rights

If you are a European User, you will have the following additional rights with respect to your European Personal Information (your “European Privacy Rights”):

  • If we intend to disclose your European Personal Information to any third party that will have the right to process your European Personal Information, we will enter into a contract with that third party that provides that your European Personal Information may be processed only for limited and specified purposes consistent with the consent that you have provided to us, and that the third party must provide the same level of protection for your European Personal Information that we are obligated to provide under this Policy. In addition, we will notify you if that third party will have the right to determine the purposes for which it will process your European Personal Information and the means it will use to process your European Personal Information (rather than just providing requested assistance to us in support of our permitted uses of your European Personal Information). In certain situations, we may be required to disclose your European Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

  • If we are processing your European Personal Information based on your consent, you may withdraw that consent at any time. Your withdrawal will not affect the lawfulness of our processing based on your consent before your withdrawal. If you withdraw your consent, we may not be able to provide our Services to you. We will advise you if this is the case at the time you withdraw your consent.

  • You may restrict our use and processing of your European Personal Information by sending us an email stating your request to [email protected], if you have contested the accuracy of that information, if the processing is unlawful, or if we no longer need such information for the purposes for which it was collected. We will then store your European Personal Information and process it only with your consent, or to establish, exercise, or defend a legal claim or to protect the rights of others. The restriction with respect to information claimed to be inaccurate would end if we verify the accuracy of that contested information.

  • We do not collect, store, or process sensitive information related to your racial or ethnic identity, political opinions, religious or philosophical beliefs, trade union membership, health (including genetic and biometric data), sex life, or sexual orientation (“European Sensitive Information”). We will not use or disclose any of your European Sensitive Information without your explicit consent, subject to certain limited exceptions. Should we wish to make any such use or disclosure, we will notify you by email and will request that you authorize such use or disclosure by responding to the email with your explicit consent.

  • Upon our receipt of your request by email at [email protected] and our verification of your identity, we will advise you whether we are processing European Personal Information concerning you and, if so, will provide you with a copy of your European Personal Information being processed and certain information about the nature and purposes of the processing. You may correct, amend, or delete any such European Personal Information that is inaccurate or incomplete. We will respond to all requests within a reasonable timeframe.

  • Upon your request by email at [email protected] and our verification of your identity, we will erase any of your European Personal Information that is no longer needed for the purpose for which it was collected or that is being used for direct marketing purposes, or if our use is based on your consent and you withdraw that consent. We will not erase such information, however, to the extent it is necessary for the establishment, exercise or defense of a legal claim or another exception applies under applicable law.

  • If we are using your European Personal Information on the basis of your consent and we change our Policy to permit any use or disclosure of your European Personal Information that is materially different than the uses for which it was originally collected or subsequently authorized by you, we will obtain your consent before we make such further uses of your European Personal Information.

Generally, you will not have to pay a fee to exercise any of your European Privacy Rights. We may, however, charge a reasonable fee if a request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in those circumstances.

We may need to request specific information from you to help us confirm your identity and to ensure your right to exercise your European Privacy Rights. This is a security measure to ensure that your European Personal Information is not disclosed to a person who does not have a right to receive it.

We try to respond to all legitimate requests related to European Privacy Rights within a reasonable timeframe. Occasionally, it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated of our progress.

A list of Supervisory Authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. 

  1. POLICY CHANGES AND UPDATES

    1. Change Notification Procedures

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes to this Policy or our practices for collecting, using, and disclosing Personal Information (including with respect to the categories of Personal Information we collect), we will:

  1. Inform you of the change through a notice on our Website home page.

  2. Update the “Last Updated” date at the top of the Policy.

    1. Your Responsibilities

You are responsible for periodically visiting our Website and this Policy to check for any changes. Please note that we will not collect additional categories of Personal Information beyond those disclosed in this Policy without providing additional notice to you, and we will not use Personal Information for additional purposes beyond those disclosed in this Policy without providing notice

  1. CONTACT INFORMATION

For questions or concerns about this Policy or our privacy practices, please contact us through one of the following methods:

  • By Email: [email protected]
  • By Postal Mail: CardSight AI, Inc.
    PO Box 442
    Biddeford, ME 04005

We will use reasonable efforts to respond your concerns promptly and thoroughly.

We use cookies to improve your experience and analyze site traffic. By clicking 'Accept', you agree to our use of cookies for analytics.