Privacy Policy

CITRO LABS PTE. LIMITED ("Citro," "we," "us," "our") is dedicated to safeguarding your privacy and personal data. This Privacy Policy ("Privacy Policy") outlines how we collect and process your personal data. This Privacy Policy applies to the egolite AI browser application (desktop and mobile), the egolite browser extension, our website (https://lite.ego.app/), our cloud-based AI agent service, and any integrations we offer with third-party messaging or communication platforms, and any associated subdomains or services, and its associated subdomains (collectively, our "Services").

If you are under 14 years old, do not meet the age requirements for using or accessing the Services in your jurisdiction, or if there are other legal restrictions applicable to your user status, please comply with local laws by either refraining from using the Services or reviewing this Privacy Policy under the supervision of your legal guardian ("Guardian"). You should only access or use the Services after obtaining your Guardian's consent as required by applicable law. If you are a parent or Guardian and become aware that your child has provided us with personal data, please contact us immediately. Should we learn that personal data has been collected from anyone under 14 years old (or the applicable legal age) without verified Guardian consent, we will promptly take measures to delete such data from our servers.

Please read this Privacy Policy carefully and in its entirety before using or continuing to use our Services. If necessary, make appropriate decisions based on the guidelines outlined herein. Failure to provide certain personal data may result in our inability to offer you the Services, restrictions on your use of the Services, or the Services not functioning as intended.

If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland (collectively, the "EEA+" areas), the United States, please also read carefully and fully and consent to the EEA+ Addendum, the US Addendum to this Privacy Policy respectively.

How We Collect and Use Your Personal Data

We collect data that you actively provide when using the Services, as well as data automatically generated during your use or interaction with the Services, through the following methods:

Account Registration. When you register an account with us, we will collect information associated with your account, including your username, email address, phone number, and account credentials. We may also collect verification codes to confirm your identity.

1. Citro Services. We provide web browsing functionality and browser interfaces that allow you to connect external AI tools of your choice. You may use these tools to access webpages and operate the browser

2. Browser Activity Data. Depending on the features you use and your settings, the browser stores browsing history, cached data, cookies and site data, download history, and browser settings locally on your device. You can manage or delete this data through the relevant settings. When you submit a search query or a form, the relevant information is sent to the applicable search provider or website. We use Google services to provide search suggestions and security checks. For these purposes, the browser may send relevant address bar input or URL-related information to Google.

3. Browser Session and Authentication Data. External AI tools that you choose to connect may use your existing authenticated browser sessions to access websites or applications in accordance with the authorization you grant through those tools. This may include viewing or interacting with content that is accessible only when you are logged in. The external AI tool manages the relevant authorization and the duration of access.

4. External AI Tool Connections and Data Access: When you connect an external AI tool, the browser provides relevant webpage content or operation results to that tool through its interfaces. This information may include personal data. During normal interface operation, this content is provided directly from your device to the external AI tool and is not received by us or our service providers. The external AI provider’s processing of the data it receives is governed by its privacy policy.

5. Sensitive Information Protection: External AI tools cannot use the browser interfaces to read or export passwords saved in the browser, authentication cookies, or session tokens. However, they may access webpages using your existing authenticated sessions. The webpage content they obtain may still contain personal data, including sensitive personal data.

6. Device Permissions. When a feature you use or a website you visit requires access to device capabilities, the browser will prompt you to grant permission through the applicable permission mechanism. Declining permission may affect the relevant functionality but will not affect other features that do not require that permission.

7. Personal Data Relating to Other Individuals. If you submit materials to us or authorize an external AI tool to access personal data relating to another individual, you must ensure that you have the right to provide that information or authorize such access.

8. Feedback. When you submit feedback, complaints, appeals, or inquiries, we process the issue description, supporting materials, contact details, and related communications you provide to understand the matter and offer support. If you submit feedback through a survey, we may also receive country information inferred by the survey provider. Where necessary to handle your request, we may ask you to provide information needed to verify your account.

9. Notification. You acknowledge and agree that we may use the contact information you provide (such as your email address) to send you various notifications related to the operation of the Services. These may include messages for identity or security verification, user updates, experience research, and dispute resolution. We may also send you promotional information about our services, features, or events via the contact details you've provided. If you prefer not to receive such promotional messages, you may unsubscribe using the method included in the message or contact us directly to opt out.

10. Payment Information. If we introduce paid features and you choose to use them, we will process order information, payment status, and related billing information necessary to complete transactions and provide those features. Payment providers process information they collect directly in accordance with their own privacy policies.

11. Safeguarding.

To support the operation of the Services and improve their functionality, we process information as follows:

Please find below the legal basis for our processing of your personal data:

Crash Reports:

To troubleshoot issues and improve stability, the browser generates crash reports locally on your device containing diagnostic information, such as error state, software version, and the time of the crash. The option to send crash reports is enabled by default during initial setup, and you may deselect it. When enabled, crash reports are uploaded to our servers.

Usage Analytics:

To measure feature usage, user activity and retention, and service performance, we record information locally and send it to our servers. This includes basic operational information, user and device identifiers, feature usage status and outcomes, and time zone information used to understand the geographic distribution of our users. We may also collect referral or acquisition channel information to measure the effectiveness of our promotional activities. We do not use this information for personalized content recommendations or targeted advertising.

Operational Logs: To support installation, updates, and troubleshooting, the installer and updater record basic operational information and relevant user and device identifiers locally on your device.

How We Use Cookies and Other Similar Technologies

We use cookies to monitor which parts of our website you visit. Cookies are small data files stored by your browser on your device. While not essential for basic website use, cookies help improve performance and functionality. Without them, some features like videos might not work properly, and you may need to log in each time because your previous login won't be remembered. Most browsers let you disable cookies, but this may restrict or block certain website functions. Importantly, we never store personal data within cookies.

We categorize cookies as follows: (i) Strictly Necessary Cookies: required for the operation of our Services (no consent required); (ii) Functional Cookies: remember your preferences and settings; (iii) Analytics Cookies: help us understand how you use our Services. For cookies other than strictly necessary cookies, we will request your consent through a cookie preference center presented when you first access our Services. You may withdraw or adjust your consent at any time through the cookie settings.

You may choose to configure your browser to block cookies and similar tracking technologies regardless of your location. However, doing so may disrupt the normal operation of our website by preventing essential cookies from being stored, which could limit or disable certain features and services. Furthermore, blocking cookies might lead to the loss of saved data such as login credentials and site preferences. Browser settings for managing cookies vary, and disabling cookies or specific categories of cookies does not automatically remove them from your device—you will need to delete them manually. For detailed instructions on managing cookies, please consult your browser's help resources. To learn more about cookies, the following online resources may be helpful: http://www.allaboutcookies.org.

How We Share, Transfer, or Disclose Your Personal Data

External AI Tool Providers: When you connect an external AI tool, relevant webpage content or operation results may be provided directly from your device to that tool through the browser interfaces. During normal interface operation, this content is not received by us or our service providers. The external AI provider processes the data it receives in accordance with its own privacy policy.

Third-Party Website and Platform Providers: When you or an external AI tool acting under your authorization interact with a third-party website or platform through the browser, information submitted to that website or platform is processed through its infrastructure under its own terms and privacy policy.

Business Partners: In order to facilitate our business operations and deliver specific services, we may share personal data with our business partners. These partners include providers of hosting, customer support, cloud infrastructure, content delivery networks, security monitoring, email communication platforms, web analytics, payment processing, transaction services, and other IT-related functions. Such partners are authorized to access, process, or store personal data solely to the extent necessary for performing their responsibilities on our behalf and strictly under our instructions.

Business Transactions: In the event of a strategic transaction, restructuring, bankruptcy, acquisition, or transfer of services to another provider (collectively referred to as a "Transaction"), your personal data may be disclosed to the counterparty and other parties involved in the Transaction for due diligence purposes. Furthermore, your personal data may be transferred to a successor or affiliate along with other assets as part of the Transaction.

Government Agencies or Other Third Parties: We may disclose your personal data, including details of your interactions with our Services, to government authorities, industry partners, or other third parties under certain circumstances: (i) to comply with applicable laws or when we have a good faith belief that such disclosure is necessary to fulfill legal obligations; (ii) to protect and enforce our rights or property; (iii) if we reasonably determine that you have breached our terms, policies, or legal requirements; (iv) to identify, prevent, or address fraud or unlawful activities; (v) to safeguard the safety, security, and integrity of our products, employees, users, or the public; or (vi) to mitigate legal risks or liabilities.

Affiliates: We may share personal data with our affiliates, who are permitted to use such data in accordance with the terms of this Privacy Policy.

Other Users and Third Parties with Whom You Interact or Share Information: Certain features allow you to engage with other users or third parties and share information. For example, you may share outputs from the Services with others via shared links, send data to third-party applications through egolite's custom actions, or perform web searches to obtain supplementary information. Please note that any information you provide to third parties is subject to their respective terms of service and privacy policies. We advise you to carefully review those terms and policies prior to sharing your data.

How We Store and Protect Your Personal Data

We will retain your personal data solely for the duration necessary to deliver our Services to you or to fulfill other legitimate business purposes, including dispute resolution, ensuring safety and security, or meeting legal requirements. The retention period for personal data will be determined based on various factors, including:

• The purpose for which we process the data, such as whether retention is necessary to continue providing our Services;

• The amount, nature, and sensitivity of the data;

• The potential risk of harm from unauthorized use or disclosure; and

• Any legal requirements that we are subject to.

We prioritize the protection of your personal data and employ commercially reasonable technical, administrative, and organizational safeguards to prevent loss, misuse, unauthorized access, disclosure, alteration, or destruction. Nevertheless, it is important to recognize that no internet or email transmission can be guaranteed to be completely secure or error-free. Therefore, we advise you to be cautious about the information you share through our Services. Additionally, we disclaim any responsibility for breaches of privacy settings or security measures on the Service or on third-party websites.

How You Can Exercise Your Personal Data Rights

You have the following legal rights concerning your personal data:

• Access your personal data and information relating to how it is processed;

• Delete your personal data from our records;

• Rectify or update your personal data;

• Transfer your personal data to a third party (right to data portability);

• Restrict how we process your personal data;

• Withdraw your consent—where we rely on consent as the legal basis for processing at any time; and

• Lodge a complaint with your local data protection authority (see below).

You have the following rights to object:

• Object to our processing of your personal data for direct marketing at any time;

• Object to how we process your personal data when our processing is based on legitimate interests; and

• Object to use your personal data to train our models.

You can exercise these rights by submitting your request to privacy@citrolabs.ai.

Services such as egolite generate responses using generative artificial intelligence models; however, the output may not always be factually accurate. Therefore, you should not rely solely on the factual correctness of the output provided by our models. If you believe that egolite has generated factually incorrect information about you and wish to request a correction or removal, you may submit your request to privacy@citrolabs.ai. We will evaluate your request in accordance with applicable laws and the technical limitations of our models.

How We Update the Privacy Policy

To continually improve our Services, updates and changes may be made from time to time. We will update this Privacy Policy accordingly, and any such updates will become an integral part of this Privacy Policy.

Once this Privacy Policy is updated, we will publish the revised version on our website and notify you through announcements about the new edition, ensuring you stay informed of the latest changes in a timely manner. If you do not agree with the updated policy or have objections to any modifications, please discontinue your use of the Services. Please note that any activities or actions you performed before deactivating your account or stopping use of the Services will still be governed by this Privacy Policy.

For any significant changes that materially reduce your rights under this Privacy Policy, we will provide you with more prominent notifications. These may include, but are not limited to, emails or special alerts displayed on browsing pages, clearly indicating the specific sections of the Privacy Policy that have been updated.

How to Contact Us

If you have any complaints, suggestions, or inquiries regarding personal data protection, or if you have questions about this Privacy Policy, please contact us at: privacy@citrolabs.ai. We will promptly review the matters raised and respond within fifteen business days after verifying your user identity.

EEA+ Addendum

If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland (collectively, the " EEA+" areas), please refer to our EEA+ Addendum in this Section. This addendum is specifically designed for individuals in the EEA+ regions. It complements our Privacy Policy and provides detailed information on how we handle your personal data when you use or interact with our services. In the event of any discrepancies between the Privacy Policy and this EEA+ Addendum, the provisions of this Addendum shall prevail.

If you are located in the EEA, the EU General Data Protection Regulation applies to our processing of your personal data, as well as local data protection laws, as the case may be. If you are located in the UK, the UK General Data Protection Regulation applies to our processing of your personal data. References to the " GDPR" are references to the General Data Protection Regulation as it applies in the country where you are located. If you are located in Switzerland, the Swiss Federal Data Protection Act (the "FDPA") applies to our processing of your personal data, and references to the GDPR below shall be interpreted analogously for the purposes of applying the FDPA.

A. Who is the data controller?

The data controller is CITRO LABS PTE. LIMITED, registered address at 67 AYER RAJAH CRESCENT, #02-10, SINGAPORE 139950, and its affiliates. To contact our GDPR representatives, please contact privacy@citrolabs.ai.

B. What types of personal data do we collect and how do we collect it?

Please see Section 1 above.

C. For what purposes do we process personal data?

Please see Section 1 above.

D. What lawful bases of processing and legitimate interests do we rely on?

Please see Section 1 above.

Where you voluntarily input health-related, biometric, or other special category personal data (as defined under Article 9 GDPR) into our Services, we process such data solely on the basis of your explicit consent (Art. 9(2)(a) GDPR) given at the time of input. You may withdraw this consent at any time. We do not actively seek to collect special category data and will delete or anonymize such data promptly if inadvertently collected without explicit consent.

E. What categories of recipients receive personal data from us?

Please see Section 3 above.

F. Where is your personal data processed and on what basis do we transfer personal data across borders?

We may transfer and disclose personal data to third parties in jurisdictions including California. To ensure an adequate level of data protection, we implement appropriate safeguards and data transfer mechanisms with our processors as required. If you have any questions or need further information, please contact us at privacy@citrolabs.ai.

G. How long do we process personal data?

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. The retention period varies depending on the specific purposes of data collection and applicable laws, including legal, regulatory, tax, accounting, or reporting requirements. When personal data is retained solely to meet legal obligations, we implement safeguards to restrict further processing. Once the personal data is no longer needed for its original purpose, we will securely delete it.

H. What data protection rights do you have?

In the EEA, Switzerland and the UK you have the following rights, subject to the conditions under the GDPR and/or local data protection law:

• You have the right to object, based on your specific situation, to our processing of your personal data. This includes the right to object to the use of your personal data for direct marketing purposes (also referred to as mass marketing under Swiss law), as well as the right to object when we process your data in the public interest or pursue our legitimate interests or those of a third party. If our processing is based on legitimate interests or the public interest, you may object, and we will stop processing your personal data unless we can demonstrate compelling legitimate reasons or legal obligations that require continued processing. For direct marketing related to our own services, you may always opt out of future marketing communications by using the unsubscribe link provided or through other available methods.

• To request from us confirmation on whether your personal data is being processed, and if so, to access information regarding how we handle your data along with copies of the personal data itself.

• To request correction of any inaccurate personal data we hold about you.

• To ask for the deletion of your personal data when it is no longer necessary for legal compliance or for security and integrity purposes.

• To request that we restrict the processing of your personal data, in which case the data will be marked and processed only for specified purposes.

• To receive your personal data in a structured, commonly used, and machine-readable format, and to transfer that data to another party without obstruction from us.

• To withdraw your consent to data processing at any time; this withdrawal will not affect the legality of any processing conducted prior to the withdrawal.

• To file a complaint with a relevant supervisory authority.

• In certain jurisdictions, such as France and Portugal, you may also have the right to provide instructions regarding the processing of your personal data after your death.

You may view a list of supervisory authorities in the EEA, UK and Switzerland and their respective contact information here:

• EEA: https://edpb.europa.eu/about-edpb/about-edpb/members_en

• United Kingdom: https://ico.org.uk/global/contact-us/

• Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

To submit a request to exercise your privacy rights, you can contact us by emailing privacy@citrolabs.ai. When submitting your request, please specify which rights you wish to exercise and how we can assist you. To verify your identity and confirm your authorization to make the request, we may ask you to provide certain information. These security measures help prevent unauthorized disclosure or improper processing of personal data. Additionally, we may reach out to you for further details to clarify your request and expedite our response. We will handle all requests to exercise your privacy rights in accordance with applicable laws.

I. Are you required to provide us with your personal data?

Providing personal data to us is voluntary; however, without certain personal data, we may be unable to deliver our Services to you.

J. Automated decision-making

We use automated processing to provide AI-powered features, including personalized recommendations and content suggestions. These processes do not produce decisions that have legal or similarly significant effects on you. To the extent any such processing constitutes profiling under Art. 4(4) GDPR, you have the right to object as described in Section 5. If we introduce automated decision-making with legal or similarly significant effects in the future, we will update this Policy and provide appropriate safeguards including the right to human review.

US Addendum

If you reside in Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island or California, please refer to the US Addendum in this Section.

We address this US Addendum to U.S. residents only. This Addendum does not reflect our collection and process of U.S. residents' personal information where an exception under U.S. privacy laws applies.

Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island

The following is only addressed to residents of Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky and Rhode Island.

Subject to the conditions under applicable laws, you have the right to request that a controller of your personal data:

• Confirm whether your personal data is being processed and provide you with copies of that data;

• Correct inaccuracies in your personal data, considering the nature of the data and the purposes for which it is processed; please note this right is not available in Iowa and Utah;

• Delete personal data provided by you or collected about you;

• Opt out of the processing of your personal data for: (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling used to make decisions that have legal or similarly significant effects on you.

When you use our Services, we may collect, use, and disclose your personal data for targeted advertising purposes as outlined above. Certain laws classify this collection, use, and disclosure of personal data for targeted advertising as the "sale" of personal data. You have the right to opt out of targeted advertising and such sales by contacting us at privacy@citrolabs.ai.

California

The following is only addressed to residents of California.

Notice of Collection: Please see Section 1 above for information about the types of personal information we collect. The categories of personal information correspond with the following categories of personal information enumerated under the California Consumer Protection Act (CCPA) definition of "personal information" and their respective letter grouping:

• (A)—Identifiers including name, phone number, unique personal identifier, IP address, email address and account name.

• (B)—Information that identifies or is capable of being associated with you.

• (F)—Internet or other electronic network activity information.

• (H)—Audio, electronic, visual or similar information.

• (K)—Inferences drawn from any of the information identified above reflecting your preferences and characteristics.

If California residents upload images or videos to our Services, they may also disclose any type of personal information to us and others in the images or videos.

Please refer to Section 1 above for details on the purposes for which we collect and use personal information. In accordance with the CCPA, we may collect, use, and disclose personal data of California residents for cross-context behavioral advertising, which the CCPA defines as "selling" and "sharing" personal information. Below, you will find a copy of our CCPA Privacy Policy, including our Notice of Right to Opt-Out of the Selling or Sharing of Personal Information.

We retain personal information solely for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. The retention period depends on the specific purposes of collection and use, as well as the duration required to meet applicable laws, including legal, regulatory, tax, accounting, or reporting obligations. Once the personal information is no longer needed for these purposes, it will be securely deleted.

We honor Global Privacy Control (GPC) signals. If your browser or device transmits a GPC signal indicating that you wish to opt out of the sale or sharing of your personal information, we will treat that signal as a valid opt-out request for the browser or device from which it is sent. Note that a GPC signal will only apply to the specific browser or device and will not affect your account-level preferences.

CCPA Privacy Policy

A. Right to Know About Personal Information Collected, Disclosed, or Sold

We collect, use, and disclose personal information about California residents, who have the right to request details regarding the personal information we have collected, used, disclosed, or sold about them ("right to know"). To exercise this right, please email privacy@citrolabs.ai with the subject line "California Request to Know," specifying the information you wish to access.

To verify your identity, we may require certain information from you; if you have a password-protected account, verification may be conducted through our existing authentication processes. The information requested for verification depends on your previous interactions with us and the sensitivity of the data involved. We will respond to your request in compliance with the California Consumer Privacy Act (CCPA), and if we deny your request, we will provide an explanation.

B. Our Personal Information Handling Practices over the Preceding 12 Months

We have set out below the categories of personal information we have collected about California residents in the preceding 12 months, as enumerated in the CCPA's definition of "personal information".

• Identifiers including name, postal address, phone number, unique personal identifier, IP address, email address and Account name.

• Information that identifies or is capable of being associated with you.

• Internet or other electronic network activity information.

• Audio, electronic, visual or similar information.

• Inferences drawn from any of the information identified above reflecting your preferences and characteristics.

We collected all these categories of personal information directly from California residents and used them according to the purposes described in this Privacy Policy. We disclosed this information as necessary. We have also "sold" and "shared" device information, browsing and usage data, and purchase history to advertising networks and advertising partners, who may use such personal information for their own purposes, including tailoring advertising to you.

C. Right to Request Correction or Deletion of Personal Information

You have a right to request the correction of personal information that we collect or maintain about you. To submit a request to correct personal information, please submit an email request to privacy@citrolabs.ai and include "California Request to Correct" in the subject line. Please specify in your request the personal information about you that you believe is incorrect, and please provide supporting material reflecting the correct information.

You have a right to request the deletion of personal information that we collect or maintain about you. To submit a request to delete personal information, please submit an email request to privacy@citrolabs.ai and include "California Request to Delete" in the subject line. Please specify in your request the personal information about you that you would like to have deleted, which can be all of your personal information as required by the CCPA.

We will require certain information from you to verify your identity. If you have a password-protected account with us, we may use our existing authentication methods to confirm your identity. The information requested for verification will depend on your previous interactions with us and the sensitivity of the data involved. After verification, we may ask you to confirm your deletion request. Once confirmed, we will process your request in accordance with the CCPA. If we deny your request, we will provide an explanation.

D. Notice of Right to Opt-Out of Selling/Sharing of Personal Information / Do Not Sell or Share My Personal Information

You have the right to opt out of the sale or sharing of your personal information by businesses. We disclose personal data to third-party advertising networks and partners who may use this information for their own purposes, including customizing advertisements directed at you. Therefore, we "sell" and "share" your personal information. To submit an opt-out request, please send an email to privacy@citrolabs.ai. Please be aware that we may require identity verification before processing your request.

E. Right to Non-Discrimination for the Exercise of a Consumer's Privacy Rights

You may not be discriminated against because you exercise any of your rights under the CCPA.

F. Right to Limit Use of Sensitive Personal Information

You have the right to direct us to limit our use of your sensitive personal information (as defined under the CPRA, which includes precise geolocation, contents of communications, and health information) to only that which is necessary to perform the Services and as otherwise permitted by the CPRA.

G. Verification Process and Authorized Agents

Only you, or an individual legally authorized to act on your behalf, may submit a request regarding your personal information. In your request, or in response to our request for further details, you or your authorized representative must provide sufficient information to allow us to reasonably verify that you are the person whose personal information was collected. The specific information required will depend on your previous interactions with us and the sensitivity of the personal data involved. We may ask for additional information to confirm your identity, and if you do not provide enough details for reasonable verification, we will be unable to process your request. Any information collected will be used solely for the purposes of identity verification and fulfilling your request.

You can designate an authorized agent to make a request under the CCPA on your behalf if:

• The authorized agent is a natural person or a business entity registered with the Secretary of State of California; and

• You sign a written declaration that you authorize the authorized agent to act on your behalf.

If you appoint an authorized agent to submit a request to exercise your right to know or your right to request deletion, the authorized agent must, in addition to following the steps described in sections A and C above:

• Mail a notarized copy of your written authorization allowing the agent to act on your behalf to 67 AYER RAJAH CRESCENT, #02-10, SINGAPORE 139950 (we will reimburse you for reasonable notarization and mailing costs upon receipt of proof); and

• Provide any information we request to verify your identity and confirm that you have granted the authorized agent permission to act under the CCPA on your behalf. The information requested for verification will depend on your prior interactions with us and the sensitivity of the personal data involved. We may deny requests if the agent does not provide sufficient proof of authorization from you.

If you grant an authorized agent power of attorney under Probate Code sections 4121 to 4130, these additional steps may not be required, and we will handle any requests from such an authorized agent in accordance with the CCPA.

H. Contact Information

If you have any questions regarding this Privacy Policy or wish to exercise your privacy rights, please reach out to us at privacy@citrolabs.ai.

Canada Addendum

These supplemental disclosures contain additional information relevant to residents of Canada. This content should be read in conjunction with the rest of our Privacy Policy. In case of conflict between our Privacy Policy and these supplemental disclosures, the supplemental disclosures shall prevail in relation to residents of Canada.

Consent. By expressly consenting to this Privacy Policy, you confirm you have read, understand, and consent to the collection, use, processing, and disclosure of your personal data in accordance with this Privacy Policy and understand that, in jurisdictions where it is available, Citro also relies on other lawful bases for the foregoing as more fully set out in this policy. We will only collect, use and disclose your personal data with your consent, unless otherwise permitted or required by law. Your consent may be given expressly or implied, depending on the circumstances and the sensitivity of the information involved. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

Cross-jurisdictional Transfers. By providing us with personal data, you acknowledge and agree that your personal data may be transferred or disclosed to other jurisdictions for processing and storage outside of Canada, including to California, where laws regarding the protection of personal data may be less stringent than the laws in your jurisdiction. Furthermore, we may disclose your personal data in these jurisdictions in response to legal processes or where we believe in good faith that disclosure is required or permitted by law.

Quebec Residents. In addition to the above, residents of Quebec have the following additional rights under Act 25: (i) the right to request that personal information collected through automated means be communicated in a structured, commonly used technological format (right to data portability); (ii) the right to request de-indexation of information that is disseminated online. Our Privacy Officer responsible for compliance in Quebec can be reached at privacy@citrolabs.ai.