PRIVACY POLICY

Effective Date: June 1, 2026

Last Updated: June 1, 2026

Fifsee Inc. ("Fifsee," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website (fifsee.com, ai.fifsee.com), iOS app, Android app, and all related services (the "Service").

We act as data controller for user personal data. This Policy complies with applicable laws including:

• GDPR (EU/EEA General Data Protection Regulation)
• UK GDPR (post-Brexit UK data protection law)
• CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act)
• PDPA and equivalents for users in Asia-Pacific regions
• App Store and Google Play privacy requirements

1. Information We Collect

1.1 Information You Provide Directly

Account Information:

• Name, email address, phone number (optional), password (hashed, never stored in plain text).
• Profile information: role selection (Buyer, Seller, Tenant, Landlord, Host, Traveler, Business), Firebase UID.

Real Estate and Travel Data:

• Property preferences, locations, budget ranges, currencies, and search criteria you enter.
• Property listings you create (FSBO mode).
• Documents and PDFs you upload or generate.
• Business type (for Business role users).

Traveler-Specific Data:

• Travel origin (traveling_from), destination, nationality, visa and entry requirements queries.
• Travel budget and dates.

Payment Information:

• Payment transactions are processed entirely by Stripe, Inc. We do not store your full card number, CVV, or other sensitive payment instrument data. We store Stripe customer IDs, payment intent IDs, and transaction records for billing and support purposes.

Communications:

• Support inquiries, feedback, and any messages you send to us.

1.2 Automatically Collected Information

Device and Technical Data:

• IP address, device type, operating system version, app version, device identifiers (Firebase Instance ID).
• Browser type (web users).

Usage Data:

• Features accessed, reports generated, AI queries submitted, tokens consumed, session timestamps.
• AI chat history (stored per session for conversational continuity; see retention below).
• Keychain-stored session tokens (iOS) and SharedPreferences tokens (Android) for authentication continuity.

Location Data:

• Location data you provide explicitly within AI queries (e.g., "show me homes near Denver, CO"). We do not collect continuous GPS background location. Location entered in report generation forms is processed to generate AI outputs.

AI Interaction Data:

• Queries you submit to AI agents (Buyer, Seller, Tenant, Landlord, Host, Traveler, Business agents).
• AI chat messages and responses (stored in session database).
• Market Insight tool interactions and report contexts.
• Get Connected service requests and categories selected.

1.3 Third-Party Sources

• Authentication data from Google (name, email, profile picture via Google SSO) and Apple (name, email via Apple SSO).
• Market data from third-party real estate data providers and public sources used to populate AI reports.
• Web search results via third-party search engine APIs used for Market News and AI grounding (query text sent; personal data minimized).
• Analytics data from Firebase/Google Analytics (usage patterns, crash reports).

2. How We Use Your Information

We use collected information to:

Provide the Service:

• Create and manage your account and role-based dashboard.
• Generate personalized AI reports, Market Insights, and Get Connected recommendations.
• Power AI chat sessions, including context-aware responses using your role, location, and report data.
• Process payments and manage token balances via Stripe.
• Generate, store, and serve PDF reports.

Improve the Service:

• Analyze usage patterns to improve AI accuracy, feature design, and performance.
• Train or fine-tune AI models using anonymized and aggregated data only. We do not use your personally identifiable information to train AI models without explicit consent.
• Debug errors and resolve technical issues.

Communicate With You:

• Send transactional emails (account confirmation, payment receipts, token grants).
• Send service updates and policy changes.
• Send marketing communications where you have opted in (you can opt out at any time).

Security and Compliance:

• Detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations, court orders, and regulatory requirements.
• Protect the rights and safety of Fifsee, users, and the public.

Legal Basis (GDPR): We process personal data under the following legal bases:

• Contract: Processing necessary to provide the Service you've signed up for.
• Legitimate Interests: Analytics, security, fraud prevention, product improvement (balanced against your rights).
• Consent: Marketing communications, certain location processing, AI model improvement.
• Legal Obligation: Compliance with applicable laws.

3. AI Data Processing — Special Notice

The Service's AI features process data you enter (locations, budgets, property preferences, travel details, business information) through third-party AI model providers:

Google Gemini (gemini-2.5-flash-lite and equivalents):

• Queries and context are sent to Google's AI APIs for response generation.
• Google's data processing practices apply: Google Cloud AI Terms.
• We configure API calls to minimize retention of personal data by Google where options are available.

Third-Party Search Engine APIs:

• Used for real-time web search in Market News and AI grounding.
• We use third-party search engine APIs for real-time web search. Search queries (typically location and market keywords, not personal identifiers) are sent to these providers.

We recommend: Do not include sensitive personal information (SSN, passport numbers, full financial account details) in AI chat queries or report inputs. Our AI agents are designed to request only what is necessary for real estate and travel intelligence.

3A. FSBO Network — Automatic Enrollment Disclosure

All Fifsee users across all seven roles (Buyer, Seller, Tenant, Landlord, Host, Traveler, and Business) are automatically enrolled in the Fifsee FSBO (For Sale By Owner) marketplace network upon account creation. This enrollment is required for core platform functionality including AI-powered matchmaking, Get Connected professional referrals, and mutual discovery between users across all roles.

The following data is used to power the FSBO network:

• Profile data shared within the network: Your selected role, general location preferences, and any profile information you voluntarily provide.
• Listing data (Sellers, Landlords, Hosts): Property details, pricing, and availability you enter when creating listings.
• Discovery data: Your search preferences and AI report contexts, used to generate relevant connection recommendations.

This data is visible to other authenticated Fifsee users for the purpose of facilitating connections within the platform. We do not sell this data to third parties outside the platform.

Opt-out: If you do not wish to participate in the FSBO network, you may delete your account at any time using the Delete Account feature in the Fifsee iOS or Android app (Settings → Account → Delete Account). Upon account deletion, your profile and listing data will be removed subject to the data retention periods described in Section 5. Partial opt-out is not available as FSBO network participation is integral to the platform's core AI matching and connectivity functions.

4. Sharing and Disclosure

We do not sell your personal data as defined under CCPA/CPRA or any applicable law.

We share data only in the following circumstances:

Service Providers (Processors):

• Stripe, Inc. — payment processing. Stripe's Privacy Policy applies to payment data.
• Google Firebase — authentication (Google SSO), real-time database, analytics, crash reporting.
• Apple — Apple SSO authentication.
• Amazon Web Services (AWS) — cloud infrastructure hosting (us-west-2 region, Oregon, USA).
• Google Gemini API — AI inference for report and chat generation.
• Third-party search engine APIs — real-time web search for AI grounding.
• All service providers are contractually bound to process data only on our instructions and in compliance with applicable privacy laws.

Business Transfers:

If Fifsee is involved in a merger, acquisition, asset sale, or bankruptcy, your data may be transferred as part of that transaction. We will notify you via email or prominent notice before such transfer.

Legal Requirements:

We may disclose data if required by law, court order, subpoena, or governmental authority, or where necessary to protect the safety, rights, or property of Fifsee, users, or the public.

With Your Consent:

For any other sharing, we will obtain your explicit consent.

International Transfers:

Data may be processed in the United States (primary), and potentially in other countries where our service providers operate. For EU/UK users, we use Standard Contractual Clauses (SCCs) or equivalent mechanisms for international data transfers to ensure adequate protection.

5. Data Retention

You may request early deletion of your data (subject to legal retention obligations) by contacting privacy@fifsee.com.

6. Data Security

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit.
• At-rest encryption for databases.
• Hashed passwords (never stored in plain text).
• API key authentication for all backend services.
• Role-based access controls for internal systems.
• Multi-factor authentication for administrative access.
• Regular security reviews.

No system is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify you and relevant authorities as required by applicable law (within 72 hours under GDPR).

7. Your Rights and Choices

All Users:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data.
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time via the unsubscribe link or by contacting us.

EU/EEA/UK Users (GDPR/UK GDPR):

• Right to Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Restrict: Request restriction of processing in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent.
• Right to Lodge a Complaint: With your national Data Protection Authority (e.g., ICO in UK, your country's DPA in EU).

California Residents (CCPA/CPRA):

• Right to Know: What personal information we collect, use, and share.
• Right to Delete: Request deletion of personal information (with exceptions).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: Where applicable.
• Non-Discrimination: We will not discriminate against you for exercising CCPA rights.

To exercise any rights, contact: privacy@fifsee.com. We respond within 30 days (or 45 days with notice for complex requests). We may need to verify your identity before fulfilling requests.

Authorized Agents (CCPA): Authorized agents may submit requests on your behalf with written authorization and identity verification.

8. Children's Privacy

The Service is not directed to children under 13 (or under 16 in EU/EEA jurisdictions). We do not knowingly collect personal information from children. If we discover we have collected data from a child without verifiable parental consent, we will delete it promptly. Contact privacy@fifsee.com if you believe a child has provided us data.

9. Cookies, Tracking, and App Permissions

Web (fifsee.com, ai.fifsee.com):

We use cookies and similar technologies for:

• Essential: Authentication sessions, security.
• Analytics: Usage patterns via Google/Firebase Analytics.
• Functional: Language preferences, role selection memory.

You can manage cookies via your browser settings. Disabling certain cookies may affect functionality.

iOS and Android Apps:

We request the following permissions with in-app explanations:

• Keychain/Secure Storage (iOS) / SharedPreferences (Android): Storing authentication tokens for seamless login.
• Network Access: Required for all AI features.
• Optional — Camera/Photo Library: For property photo uploads (FSBO mode). Requested only when needed.

You can revoke app permissions via your device settings at any time.

10. Third-Party Links and Services

The Service provides deep links to third-party platforms via AI-generated links and chips. We do not crawl or scrape any third-party websites. We are not responsible for the privacy practices of these platforms. We encourage you to review their privacy policies before use.

11. International Users

The Service is available globally. By using the Service from outside the United States, you consent to the transfer and processing of your data in the US and other countries where our providers operate, subject to appropriate safeguards.

For EU/EEA/UK users, we rely on Standard Contractual Clauses for transfers to the US.

For users in India, Australia, Canada, Singapore, UAE, and other jurisdictions with specific data protection laws, we aim to comply with applicable local requirements. Contact us if you have jurisdiction-specific questions.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• Email to your registered address.
• In-app notification.
• Notice on our website.

The "Last Updated" date at the top of this Policy indicates when it was last revised. Continued use of the Service after the effective date of changes constitutes acceptance of the revised Policy.

13. Contact Us

Privacy Inquiries and Rights Requests:

privacy@fifsee.com

Legal and Compliance:

legal@fifsee.com

General Support:

support@fifsee.com

Mailing Address:

Fifsee Inc.

8 The Green, Suite A

Dover, Delaware 19901

USA

EU/UK Representative: [To be designated if required by GDPR Article 27. Contact legal@fifsee.com for current representative details.]

Data Protection Officer: [To be designated if required. Contact legal@fifsee.com.]

These documents are intended as a strong starting point. Fifsee should have a qualified attorney review and finalize before publication, particularly for GDPR Article 27 representation requirements, jurisdiction-specific disclosures, and any features launched after the effective date.