Privacy Policy

01

Introduction and Scope

This Privacy Policy ("Policy") describes how Legacy Buddy, LLC, a Tennessee limited liability company ("Legacy Buddy," "we," "us," "our"), collects, uses, shares, and protects personal information when you use the Legacy Buddy platform, website (legacybuddy.com), mobile application, and all related services (collectively, the "Platform").

By creating an account or using the Platform, you agree to the collection and use of your information as described in this Policy. If you do not agree with this Policy, please do not use the Platform.

1.1 Scope

This Policy applies to all users of the Legacy Buddy Platform, including consumers (individuals using estate planning and wealth management tools) and professional partners (attorneys, CFPs, Wealth Managers, and Insurance Professionals). Where certain provisions apply only to specific user types, this Policy says so explicitly.

1.2 Geographic Scope

The Legacy Buddy Platform is designed for and made available to residents of the United States only. If you are not a U.S. resident, please do not use the Platform. This Policy is drafted to comply with U.S. federal privacy law, including the Gramm-Leach-Bliley Act (GLBA), and applicable state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA).

1.3 Governing Law

This Policy is governed by the laws of the State of Tennessee and applicable federal law. By using the Platform, you consent to the privacy practices described in this Policy and to the jurisdiction of Tennessee courts for any privacy-related dispute not subject to arbitration.

1.4 Contact for Privacy Questions

If you have questions about this Policy or wish to exercise your privacy rights, contact us at: legal@legacybuddy.com or through the privacy request form at legacybuddy.com/privacy-rights.

02

Information We Collect

2A Information You Provide Directly

Account Registration

When you create a Legacy Buddy account, we collect: full legal name, date of birth (for age verification), email address, U.S. residential address, and phone number.

Estate Planning Information

To generate estate documents and compute your Legacy Quotient (LQ) Score, we collect the information you provide through our guided questionnaires, including:

• Beneficiary names, relationships, contact information, and allocation details;
• Executor and trustee names and contact information;
• Guardian designations for minor children;
• Healthcare agent designations;
• Family structure information (marital status, dependents, children);
• Business ownership status and succession intentions;
• Charitable giving intentions and estate allocation preferences.

Financial Information

To power Legacy Lens™, LQ Score computation, and wealth tracking, we collect financial information you provide, which may include:

• Net worth estimates, asset values, and debt balances (provided manually or imported via Plaid);
• Investment account categories (Checking/Savings, Investments, Retirement, Real Estate, Business Equity, through Plaid, with your explicit consent);
• Property values (retrieved from Zillow based on addresses you provide, with your consent);
• Income estimates and financial goals.

Plaid Connection is OPTIONAL

You are never required to connect your financial accounts through Plaid. You may enter financial information manually at any time. If you choose to connect through Plaid, only categorized net worth tier data and asset category indicators are retained by Legacy Buddy. Specific account balances, account numbers, and transaction histories are not stored on Legacy Buddy's servers.

Social Security Number (Partial)

For certain document types (particularly Trusts), we may collect the last four digits of your Social Security Number for document accuracy. We do not collect or store full Social Security Numbers. SSN fragments are classified as Sensitive Personal Information and are subject to heightened protections described in Section 8.

Payment Information

When you purchase a subscription or one-time service, payment information (credit card number, expiration date, billing address) is collected and processed directly by Stripe, Inc. Legacy Buddy does not store, log, or retain credit card numbers, CVV codes, or other sensitive payment card data on its own servers.

Communications

If you contact Legacy Buddy by email, through support channels, or through the Legacy Counsel system, we retain records of those communications to respond to your inquiries and to improve our services.

2B Information Collected Automatically

When you use the Platform, we automatically collect certain technical and behavioral information:

• Usage Data: Pages visited, features accessed, documents created or updated, time spent on the Platform, click patterns, and feature interaction history.
• Device Data: Device type, operating system, browser type and version, screen resolution, and device identifiers.
• Network Data: IP address, general geographic location (city/state level, derived from IP), and internet service provider.
• Session Data: Login timestamps, session duration, and authentication activity.
• Error and Performance Data: Crash reports, loading times, and other performance metrics used to maintain and improve the Platform.

Cookies and Tracking Technologies

Legacy Buddy and its service providers use cookies, pixel tags, web beacons, and similar tracking technologies to collect information about your interactions with the Platform. The following tracking tools are currently active on the Platform:

For full details on cookies used and how to manage your cookie preferences, see our Cookie Policy at legacybuddy.com/cookie-policy.

2C Information From Third Parties

Plaid Technologies, Inc.: With your explicit consent, Plaid provides us with categorized financial account data. We receive asset category indicators (Checking/Savings: Yes/No; Investments: Yes/No; Retirement: Yes/No; Real Estate: Yes/No; Business Equity: Yes/No) and a net worth tier calculation. We do NOT receive raw account balances, account numbers, routing numbers, or transaction histories from Plaid.

Plaid End User Privacy Policy Disclosure and Consent

Legacy Buddy uses Plaid Technologies, Inc. ("Plaid") to allow you to connect your financial accounts to the Platform, at your option. By choosing to connect a financial account through Plaid, you understand and agree that Plaid will collect and use your financial data in accordance with Plaid's own End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy. We encourage you to review Plaid's End User Privacy Policy before connecting an account.

To the extent Plaid processes your personal information as an independent controller of that information (rather than solely as Legacy Buddy's service provider), Plaid's use of your information is governed by Plaid's own privacy policy referenced above, not this Privacy Policy. By clicking "Continue" or "Connect" within the Plaid account connection flow, you consent to Plaid's collection, use, and sharing of your information as described in Plaid's End User Privacy Policy.

As described elsewhere in this Policy, connecting a financial account through Plaid is entirely optional. You may use all core features of the Legacy Buddy Platform, including document creation and Legacy Vault, by entering your financial information manually. If you choose not to connect through Plaid, Plaid will not collect any information about you.

Zillow Group, Inc.: With your consent, when you provide a U.S. property address, we retrieve Zillow's estimated property value (Zestimate) for that address to enhance your net worth calculation within Legacy Lens™. Property addresses and Zestimate values are stored as part of your financial profile.

Stripe, Inc.: Stripe confirms payment authorization and transaction status to Legacy Buddy. We receive confirmation of whether a payment succeeded or failed, your billing address (for tax purposes), and a payment method identifier (last four digits). No full card data is transmitted to or stored by Legacy Buddy.

Identity and Credential Verification: For professional partners (attorneys, CFPs, Insurance Professionals), we collect and verify professional credentials through FINRA BrokerCheck, SEC IAPD, NIPR (National Insurance Producer Registry), state bar verification systems, SAM.gov, OFAC SDN, and OIG LEIE databases. These checks are conducted at onboarding and periodically thereafter.

03

How We Use Your Information

Legacy Buddy uses the information we collect for the following purposes:

3.1 Service Delivery

• Creating, storing, and delivering estate planning documents based on your questionnaire inputs;
• Computing and displaying your Legacy Quotient™ (LQ™) Score and pillar-level breakdowns;
• Powering Legacy Lens™ wealth visualization, goal tracking, and net worth monitoring;
• Facilitating Smart Review document review assignments between you and independent licensed attorneys;
• Facilitating Legacy Counsel attorney consultations through the platform's video/audio system;
• Processing subscription payments and managing billing through Stripe;
• Delivering notifications, status updates, and reminders via email and SMS.

3.2 AI-Powered Features and Recommendations

• Generating personalized estate planning recommendations based on your LQ Score, life stage, financial profile, and document completion status;
• Powering professional matching, connecting you with verified professionals whose practice areas and geographic coverage align with your estate planning needs;
• Personalizing educational content surfaced within the Platform based on your profile and activity.

All AI inference occurs on Legacy Buddy's own AWS infrastructure. Your data is never sent to external AI providers for processing. See Section 4 for full ADMT disclosure.

3.3 Professional Marketplace

If you have opted in to professional matching (the default setting, adjustable in Privacy Settings), your anonymized profile, including net worth tier, LQ Score, and general location, may be made available to verified professionals in the Legacy Buddy marketplace. Full contact information is released to a professional only after they complete a lead purchase. See Section 5 for full details on how information is shared with professionals.

3.4 Security and Fraud Prevention

• Verifying your identity and age at account creation;
• Detecting and preventing fraudulent account creation, document manipulation, and unauthorized access;
• Monitoring for suspicious activity using AWS GuardDuty and related security services;
• Maintaining audit logs of all significant account and document actions for security investigation.

3.5 Legal Compliance and Record-Keeping

• Complying with applicable laws, regulations, court orders, and legal process;
• Maintaining records required under the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule;
• Meeting data retention obligations under Tennessee law and applicable federal law;
• Exercising or defending Legacy Buddy's legal rights in disputes.

3.6 Platform Improvement

• Analyzing usage patterns (using anonymized, aggregated data) to improve the Platform's features, performance, and user experience;
• Training and improving AI models using anonymized, aggregated, non-personally-identifiable data. No raw individual records are used in model training;
• Conducting internal research and quality assurance.

04

AI and Automated Decision-Making (ADMT)

4.1 How Legacy Buddy Uses AI

Legacy Buddy uses proprietary artificial intelligence (AI) and machine learning systems to power key Platform features. These systems are fully self-hosted on Legacy Buddy's own Amazon Web Services (AWS) infrastructure inside a private virtual private cloud (VPC). Your personal data is never transmitted to external AI APIs, including those operated by OpenAI, Google, Anthropic, or any other third-party AI provider.

The AI models powering the Platform include Gemma (a Google open-source model) and Claude (an Anthropic model), both deployed exclusively on Legacy Buddy's own servers. Legacy Buddy is the sole controller of these models and their outputs.

4.2 Which Systems Use Automated Decision-Making

4.3 Legacy Score™ Plain-Language Explanation

Your Legacy Quotient™ (LQ™) Score is calculated from four pillars. The table below explains what each pillar measures:

Trade Secret

The specific mathematical weights, multipliers, and formula applied to calculate your final LQ Score from these four pillars are proprietary trade secrets of Legacy Buddy, LLC. They are not disclosed to users, professional partners, or third parties. This protects the integrity and competitive value of the scoring system.

4.4 Your ADMT Rights

Subject to applicable law, including the CCPA/CPRA Automated Decision-Making Technology (ADMT) Regulations (finalized September 2025, effective January 1, 2026; ADMT notice and opt-out obligations for significant decisions phased in from January 1, 2027), you have the following rights:

• Right to Know: You may request information about how automated systems have been used to process your data and what outputs were generated. Contact legal@legacybuddy.com.
• Right to Opt Out: You may opt out of all AI-powered features at any time in Account Settings > Privacy > AI-Powered Features. Core document creation, Legacy Vault access, and manual professional directory browsing are not affected by opting out.
• Right to Human Review: For decisions that materially affect your account status, you may request that a Legacy Buddy team member review the decision. Contact legal@legacybuddy.com.
• Right to Explanation: You may request a plain-language explanation of any specific AI-generated recommendation or score output. Contact legal@legacybuddy.com.

4.5 ADMT Compliance and Risk Assessment

Legacy Buddy conducts pre-deployment algorithmic impact assessments for all ADMT systems. Assessments cover potential for discriminatory outputs, accuracy validation methodology, bias testing across demographic cohorts, human review processes, and model drift monitoring procedures. Assessment records are maintained and available to regulators upon request.

05

Information Sharing

We Do Not Sell Your Personal Information

Legacy Buddy does NOT sell your personal information. We do not sell, rent, or trade your name, email address, financial data, estate documents, or any other personal information to third parties for their own marketing purposes.

We Do Not Use External AI Providers

All AI inference runs on Legacy Buddy's own AWS infrastructure. Your personal data is never transmitted to OpenAI, Google AI APIs, Anthropic API endpoints, or any other external AI service for processing.

5.1 With Professional Partners

If you have opted in to professional matching (adjustable at any time in Privacy Settings), your profile may be visible to verified professionals in the Legacy Buddy marketplace. Sharing is governed by the following rules:

Professionals who purchase your profile are bound by the Legacy Buddy Professional Partner Agreement, which restricts use of your data to direct professional outreach for their own practice only. Resale or sharing of your data with third parties by professionals is prohibited.

ATTORNEY EXCLUSION: Attorneys are permanently excluded from the lead purchase system. Attorneys cannot purchase consumer profiles. Attorneys access consumers only through Legacy Counsel (user-initiated) and Smart Review (user-initiated).

5.2 With Service Providers (Subprocessors)

Legacy Buddy shares data with the following service providers as necessary to operate the Platform. All subprocessors operate under data processing agreements requiring them to protect your data and use it only for the purposes we specify:

This subprocessor list is updated as our service relationships change. The current list is always available at legacybuddy.com/subprocessors.

5.3 Legal Disclosures

Legacy Buddy may disclose your personal information to law enforcement agencies, government authorities, courts, or other third parties when we believe in good faith that disclosure is necessary to:

• Comply with a valid legal obligation, court order, subpoena, or search warrant;
• Respond to lawful requests from governmental authorities in the jurisdiction where we operate;
• Protect the rights, property, or safety of Legacy Buddy, our users, or others;
• Detect, prevent, or address fraud, security, or technical issues;
• Enforce our Terms of Service.

Where permitted by law, Legacy Buddy will attempt to notify you before disclosing your personal information in response to a legal demand.

5.4 Business Transfers

If Legacy Buddy is acquired by, merges with, or transfers substantially all of its assets to another entity, your personal information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Platform at least 30 days before your information becomes subject to a different privacy policy. If you object to such a transfer, you may request deletion of your account before the transfer takes effect.

06

GLBA Privacy Notice: Your Financial Privacy Rights

FACTS

What Does Legacy Buddy, LLC Do With Your Personal Financial Information?

Why?

Financial companies choose how they share your personal financial information. Under federal law, you have the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal financial information. Please read this notice carefully to understand what we do.

What?

The types of personal financial information we collect and share depend on the products and services you use. This information can include:

• Net worth estimates, asset values, and debt balances (provided by you or via Plaid with your consent)
• Asset category data from connected financial accounts (Plaid)
• Property values from connected addresses (Zillow)
• Income estimates and financial goals you provide
• Estate planning data including beneficiary relationships and asset allocation intentions

How?

All financial institutions need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal financial information; the reasons Legacy Buddy chooses to share; and whether you can limit this sharing.

QUESTIONS? Contact us: legal@legacybuddy.com | Call: +1 (508) 558-1477 | Visit: legacybuddy.com/glba-notice

6.1 What We Do

How does Legacy Buddy protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include AES-256 encryption of data at rest, TLS 1.3 for data in transit, Amazon Cognito multi-factor authentication, and a GLBA-compliant written information security program (WISP).

How does Legacy Buddy collect my personal information? We collect your personal financial information, for example, when you: create an account and provide your financial profile; connect financial accounts through Plaid; provide property addresses for Zillow valuation; or use Legacy Lens™ to track and update your net worth and financial goals.

Why can't I limit all sharing? Federal law gives you the right to limit only: (a) sharing for affiliates' everyday business purposes (information about your creditworthiness); (b) affiliates from using your information to market to you; (c) sharing for non-affiliates to market to you. State laws and individual companies may give you additional rights to limit sharing.

6.2 Definitions

Affiliates: Companies related to Legacy Buddy by common ownership or control. Legacy Buddy currently has no affiliated companies.

Non-Affiliates: Companies not related to Legacy Buddy by common ownership or control.

Joint Marketing: A formal agreement between non-affiliated financial companies that together market financial products and services to you. Legacy Buddy does not participate in joint marketing arrangements.

07

California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information. This Section describes those rights and explains how to exercise them.

No Sale of Personal Information

Legacy Buddy does NOT sell your personal information to third parties. The right to opt out of sale applies when a business sells PI. Since Legacy Buddy does not sell personal information, this right is preserved but not actively exercised (there is nothing to opt out of for sales purposes). However, you may still opt out of the sharing of your information for cross-context behavioral advertising (for example, Meta Pixel data for ad targeting) using the footer link "Do Not Sell or Share My Personal Information."

7.1 Your CCPA/CPRA Rights

Right to Know (Access)

You have the right to request that Legacy Buddy disclose: the categories of personal information we have collected about you; the categories of sources from which we collected it; our business or commercial purpose for collecting, selling, or sharing it; the categories of third parties to whom we disclose it; and the specific pieces of personal information we have collected about you.

Right to Delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions. Exceptions include: information needed to complete the transaction for which it was collected; information needed to detect security incidents or fraud; information required to fulfill a legal obligation; or information used solely for internal purposes consistent with your reasonable expectations.

Right to Correct

You have the right to request that Legacy Buddy correct inaccurate personal information we hold about you. Legacy Buddy will use commercially reasonable efforts to correct the inaccuracy.

Right to Opt Out of Sale/Sharing

Legacy Buddy does not sell personal information. You may opt out of the sharing of your personal information for cross-context behavioral advertising by clicking "Do Not Sell or Share My Personal Information" in the footer of our website or by managing cookie preferences in your account settings.

Right to Limit Use of Sensitive Personal Information

See Section 8 for full details on Sensitive Personal Information and how to exercise your right to limit its use.

Right to Non-Discrimination

Legacy Buddy will not discriminate against you for exercising your CCPA/CPRA rights. We will not deny you services, charge you different prices, provide a lower quality of service, or suggest that you will receive a lower quality of service because you exercised your rights under this Policy.

7.2 How to Submit a CCPA/CPRA Rights Request

You may submit a rights request using either of these methods:

• Email: legal@legacybuddy.com, include "California Privacy Request" in the subject line, your name, email address, and a description of your request.
• Web Form: legacybuddy.com/privacy-rights, complete the online privacy request form.

For security, we will verify your identity before processing your request. We will use information you have previously provided (account email, registered name) to verify your identity. For certain sensitive requests (deletion), we may require additional verification.

7.3 Response Timeframes

We will respond to your verified request within 45 days of receipt. If we need more time, we will notify you in writing within the initial 45-day period and may extend our response by an additional 45 days (90 days total), with an explanation of the reason for the extension.

We will respond to your request at no charge, unless your requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse to act.

08

Sensitive Personal Information (CPRA)

Under the California Privacy Rights Act (CPRA), certain categories of personal information receive additional protections as "Sensitive Personal Information" (SPI). Legacy Buddy collects and processes the following categories of SPI:

8.1 Purpose Limitation for SPI

Legacy Buddy uses Sensitive Personal Information only for the purposes described in this Policy and as permitted under the CPRA's limited purposes exception. We do not use SPI to infer characteristics about you beyond what is necessary for the services you have requested.

8.2 How to Limit Use of Your SPI

You have the right to direct Legacy Buddy to limit its use and disclosure of your Sensitive Personal Information to only those purposes necessary to perform the services you requested, to ensure security and integrity, to prevent fraud, and to comply with law.

To exercise this right:

• Click "Limit the Use of My Sensitive Personal Information" in the footer of legacybuddy.com, or
• Navigate to Account Settings > Privacy > Sensitive Personal Information and adjust your preferences, or
• Submit a written request to legal@legacybuddy.com.

Effect of limiting SPI use: Limiting SPI use may affect Legacy Score accuracy (if financial account data is excluded), lead marketplace participation (if net worth tier data is excluded), and document generation completeness (if beneficiary data is excluded). Core document creation functionality will remain available.

09

ADMT Opt-Out: California and Colorado AI Regulations

This Section addresses your rights under the CCPA/CPRA Automated Decision-Making Technology (ADMT) Regulations (finalized September 2025, effective January 1, 2026) and the Colorado Artificial Intelligence Act (SB 24-205, effective June 2026).

9.1 ADMT Systems on Legacy Buddy

The following systems constitute ADMT under California and Colorado law because they use computation to replace or substantially replace human decision-making in contexts that may materially affect you:

• Legacy Score™ (LQ™ Score): Automated scoring system that produces your estate readiness score and drives personalized recommendations. Classified as ADMT affecting financial services decisions.
• Lead Marketplace Matching: Automated system that determines whether and how your anonymized profile is presented to financial and insurance professionals in the marketplace.
• Professional Recommendations: Automated system that determines which professionals are suggested to you based on your LQ Score and profile.

9.2 How to Opt Out of ADMT

To Opt Out of All ADMT-Powered Features

Go to Account Settings > Privacy > AI-Powered Features > Toggle OFF. This disables the Legacy Score™, all AI-generated recommendations, automated professional matching, and content personalization. Your opt-out preference will be honored within 24 hours.

9.3 What Is NOT Affected by ADMT Opt-Out

Opting out of ADMT does not affect your ability to:

• Create, edit, download, and manage estate documents (Wills, Trusts, POAs) through the Document Builder;
• Store and organize documents in Legacy Vault;
• Browse and manually search the Professional directory;
• Request Smart Review or Legacy Counsel engagements;
• Manage your account, billing, and notifications.

9.4 Right to Access Information About Automated Decisions

You have the right to request a plain-language description of any ADMT output that affected you. This includes: how your Legacy Score was calculated (including which pillar scores contributed and in what relative direction, but not the proprietary formula weights); what factors triggered a specific recommendation; and why a specific professional was or was not matched to your profile. Submit requests to legal@legacybuddy.com.

9.5 Colorado AI Act Compliance

Legacy Buddy's AI systems that qualify as "high-risk" under the Colorado AI Act (those affecting financial services or similar significant decisions) are subject to an annual impact assessment. Legacy Buddy provides consumers with pre-deployment notices, opt-out mechanisms, and the right to appeal AI-driven significant decisions to a human reviewer. For consumers in Colorado, these rights are in addition to those described in Section 7.

10

Data Retention

Legacy Buddy retains personal information for as long as necessary to provide services, fulfill legal obligations, resolve disputes, and enforce agreements. The table below describes our retention schedule:

10.1 Amazon Glacier Archival

Documents that are more than 12 months old and have not been accessed are automatically moved to Amazon Glacier, a secure archival storage service that provides 99.999999999% (11 nines) durability. Archived documents remain accessible to you through your Legacy Vault but may take 3 to 5 hours to retrieve from archival storage. Glacier archival is used to maintain legal hold compliance while reducing active storage costs.

10.2 Data Export Rights

You may request an export of your Legacy Buddy data at any time. To export:

• For documents: download directly from Legacy Vault in PDF or DOCX format;
• For all account data: submit a data portability request to legal@legacybuddy.com; we will provide your data in a machine-readable format within 45 days.

11

Security

Legacy Buddy takes the security of your personal information seriously, particularly given the sensitivity of estate planning and financial data held on the Platform. We implement a layered security architecture designed for compliance with the GLBA Safeguards Rule, SOC 2 Trust Service Criteria, and AWS security best practices.

11.1 Technical Security Measures

• Encryption at Rest: All data stored in AWS Aurora PostgreSQL, DynamoDB, and S3 is encrypted using AES-256, the same standard used by U.S. federal agencies and major financial institutions. Encryption keys are managed via AWS Key Management Service (KMS) and stored separately from the data they protect.
• Encryption in Transit: All data transmitted between users and Legacy Buddy's servers uses TLS 1.3, the latest and strongest version of transport layer security.
• Authentication: Amazon Cognito with multi-factor authentication (MFA) is enforced for all user accounts. Professional partners require verified credentials before access is granted.
• Network Isolation: All backend services, including AI inference endpoints, operate inside a private AWS Virtual Private Cloud (VPC) inaccessible directly from the internet. AWS WAF (Web Application Firewall) and AWS Shield (DDoS protection) protect public-facing infrastructure.
• AI Infrastructure: AI models run inside the private VPC on dedicated EC2 GPU instances. No AI model endpoint is publicly accessible. All AI inference traffic stays on the AWS internal network.
• Penetration Testing: Annual third-party penetration testing is conducted by an independent security firm. Continuous vulnerability scanning via AWS Inspector and Vanta.

11.2 SOC 2 Readiness

Legacy Buddy is building toward SOC 2 Type II certification. Our infrastructure is designed to meet SOC 2 Trust Service Criteria across Security, Availability, Processing Integrity, Confidentiality, and Privacy. Compliance monitoring is managed through Vanta. SOC 2 Type I readiness assessment is targeted for Q4 2026; SOC 2 Type II report is targeted for Q1 to Q2 2027. The SOC 2 Type II report will be available to enterprise partners and institutional clients upon issuance.

11.3 GLBA Safeguards Rule Compliance

Legacy Buddy maintains a written information security program (WISP) as required by the GLBA Safeguards Rule (16 C.F.R. Part 314, as amended 2023). The WISP covers: designated qualified individual responsible for overseeing security; risk assessments; technical, physical, and administrative safeguards; service provider oversight; continuous monitoring and testing; employee training; and incident response plan.

11.4 No Guarantee of Absolute Security

Important

Despite our best efforts, no security system is impenetrable. We cannot guarantee that unauthorized third parties will never be able to defeat our security measures or access your personal information for impermissible purposes. You use the Platform at your own risk.

11.5 Data Breach Notification

In the event of a data breach that is reasonably likely to result in harm to you, Legacy Buddy will notify affected users as required by applicable law. GLBA breach notification to the FTC is required within 30 days if 500 or more consumers are affected (effective May 13, 2024). We will notify you at your registered email address as promptly as practicable and consistent with applicable law enforcement requirements.

12

Children's Privacy

The Legacy Buddy Platform is intended exclusively for users who are 18 years of age or older. The Platform is not directed at, and we do not knowingly collect personal information from, children under the age of 18.

The Children's Online Privacy Protection Act (COPPA) requires parental consent for online collection of personal information from children under 13. Because the Legacy Buddy Platform is strictly for adults and does not collect information from children, COPPA does not apply to our operations.

If we become aware that we have inadvertently collected personal information from a person under 18, we will take prompt steps to delete that information and terminate the account. If you believe a person under 18 has created an account on Legacy Buddy, please contact us immediately at legal@legacybuddy.com so we can investigate and take appropriate action.

13

Cookie Policy Summary

Legacy Buddy uses cookies, pixel tags, web beacons, and similar tracking technologies on its website and Platform. A full description of the cookies we use, their purposes, and how to manage them is available in our Cookie Policy at legacybuddy.com/cookie-policy.

In summary:

• Strictly Necessary Cookies: Required for basic Platform functionality, including authentication, security, and payment session management. These cannot be disabled without preventing core features from working.
• Analytics Cookies: Google Analytics, PostHog, and Microsoft Clarity collect anonymized or pseudonymized data about how users navigate the Platform to help us improve its design and performance.
• Marketing Cookies: Meta Pixel collects data about page visits and conversion events for use in Meta advertising campaigns. HubSpot tracking cookies collect data about page visits and form submissions for marketing communications.

You may manage cookie preferences through your browser settings, through the consent management controls in your Legacy Buddy account (Account Settings > Privacy > Cookie Preferences), or through the individual opt-out tools described in Section 14. Disabling strictly necessary cookies will impair the functionality of the Platform.

Legacy Buddy honors the Global Privacy Control (GPC) browser signal as a valid opt-out from the sale and sharing of personal information for California users, consistent with CCPA/CPRA requirements.

14

Analytics and Tracking

Legacy Buddy uses the following analytics and tracking tools on the Platform. We provide detailed information about each tool and how to opt out:

Legacy Buddy does not use cross-device tracking for advertising purposes. Analytics data collected through these tools is used exclusively for improving the Platform and measuring our own marketing performance. It is not sold or shared with third parties for their own advertising purposes.

15

Third-Party Links

The Platform may contain links to third-party websites, resources, and services. These links are provided for your convenience and do not constitute an endorsement by Legacy Buddy of the content, products, services, or privacy practices of those third-party sites.

When you leave the Legacy Buddy Platform through a third-party link, you are subject to the privacy policy and terms of service of that third-party site. Legacy Buddy has no control over and is not responsible for the privacy practices, security measures, or content of any third-party website.

We encourage you to review the privacy policy of every website you visit before providing any personal information.

16

Changes to This Privacy Policy

Legacy Buddy may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or Platform features. When we make material changes to this Policy, we will:

• Notify you by email to your registered email address at least 30 days before the changes take effect;
• Post a prominent notice on the Platform;
• Update the "Last Updated" date at the top of the Policy;
• For significant changes that affect your rights or how we use sensitive data, require re-acknowledgment through the Platform.

Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you must stop using the Platform and may request deletion of your account.

We encourage you to review this Policy periodically. The current version is always available at legacybuddy.com/privacy.

17

Contact

For questions about this Privacy Policy, to exercise your privacy rights, or to report a privacy concern, please contact us:

18

Your Rights: Quick Reference Summary

The following table summarizes all privacy and data rights available to Legacy Buddy users under applicable law. Your specific rights may vary depending on your state of residence.

Legacy Buddy provides document creation tools, not legal advice. | Legacy Buddy, LLC | legal@legacybuddy.com | legacybuddy.com

Footer Content:

Legacy Buddy

Build. Grow. Pass it on.

The first platform that combines estate planning with generational wealth building, for every American family.

Platform

• How It Works
• The LQ™ Score
• Legacy Lens™
• Document Builder

Company

• About
• For Professionals
• Investors
• Join the Waitlist

Free Tools

• LQ™ Quiz
• Estate Readiness Guide

Legal

• Privacy
• Terms
• Disclaimer

Legacy Buddy provides document creation tools, not legal advice.

© 2026 Legacy Buddy. All rights reserved.