Golten Privacy Notice

Last Updated: September 26, 2026

This Golten Privacy Notice (the "Notice") describes how Golten, Inc. and its affiliates ("Golten," "we," "us," or "our") collect, use, disclose and otherwise process information about you in the course of running our business. That includes our websites that link to this Notice, such as golten.ai (the "Sites"); our agentic master data management software, including its APIs and MCP server (the "Platform"); our evaluation, implementation, support and other professional services (together with the Platform, the "Golten Offerings"); and our sales and marketing activities. This Notice also explains the privacy rights available to you.

About the Golten Platform. We provide the Golten Offerings to business customers under a written agreement with each customer (a "Customer Agreement"). The Platform is self-hosted: each customer deploys and runs it inside the customer's own cloud environment, such as the customer's Microsoft Azure tenant. Customers decide which of their personnel, contractors and agents may use the Platform ("Authorized Users").

This Notice does not apply to the records that customers ingest, resolve, merge, store or otherwise process using the Platform, such as their customer, account, household or product records ("Customer Data"). Customer Data often includes personal information and sensitive personal information, such as names and contact details, dates of birth, government identification numbers (for example, Social Security numbers), financial account information and credit information. Customer Data stays in the customer's environment and is controlled by the customer, which is responsible for having a lawful basis to collect and use it and for giving its own privacy notice to the individuals concerned. Golten does not have access to Customer Data in the ordinary course. If your information is part of a customer's Customer Data, that customer's privacy notice applies, not this one, and you should direct any questions to that customer. Section 13 explains more. The limited operational data the Platform sends to Golten ("Usage Data") is not Customer Data and is covered by this Notice, as described in Section 2.

Support access to Customer Data. Golten personnel access a customer's environment or Customer Data only when the customer authorizes it, for example to troubleshoot an issue or to assist with an implementation. When they do:

• access is limited to what is needed for the authorized task, and to the time the task takes;
• access is carried out only by personnel who are bound by confidentiality obligations;
• we process Customer Data only on the customer's documented instructions, under the Customer Agreement and any data processing agreement with that customer;
• we do not sell Customer Data, use it for our own purposes, combine it with other data, or use it to train artificial intelligence models; and
• we do not keep copies of Customer Data after the task is complete, unless the customer instructs us otherwise or the law requires it.

Sample data on the Sites. The customer records, contact details, account information and relationship graphs shown on the Sites to demonstrate the Platform are fictitious and for illustrative purposes only. They were not collected from any real person or Golten customer, and no Customer Data is displayed on the Sites.

1. Information You Provide

When we ask you for personal information, we will tell you at that point why we need it and whether providing it is required or optional.

When using the Sites: We may collect your name, work email address, phone number, company, job title, and anything else you choose to tell us, for example when you request a demo, contact us, download a white paper or architecture document, answer a survey, give feedback, or sign up for marketing updates.

When evaluating or using the Golten Offerings: When your organization evaluates, buys or uses the Golten Offerings, we may collect business contact details for the people involved, such as Authorized Users, administrators, billing contacts and project sponsors. We also collect the information you choose to include in support tickets, implementation plans and other project materials. We ask customers not to include Customer Data in support tickets. If they do, we treat that information as Customer Data and handle it as described under "Support access to Customer Data" at the beginning of this Notice.

When communicating with us: We may collect your name, title, email address, company and other information you provide when you talk with us in person, by email, by phone or by video conference. With notice and, where required, your consent, this may include call recordings and transcripts.

2. Information We Automatically Collect

When using the Sites: When you visit the Sites, we and our service providers automatically receive certain information about your device and your visit. This includes your IP address, browser type and language, operating system, the page that referred you, the pages you view, and the date and time of your visit. Some of this information can identify you. We may use cookies, local storage and similar technologies to collect it, as described in Section 5 and in our Cookie Preferences page. We may share device information with service providers who help us keep the Sites secure and detect fraud.

When using the Platform: The Platform runs in the customer's own environment, and Golten does not receive Customer Data from it in the ordinary course. The Platform does send Golten limited operational data ("Usage Data"), such as the software version, license and deployment identifiers, deployment health and performance metrics, feature usage, and error reports. Usage Data, including error reports, never includes Customer Data records or the sensitive personal information they contain. The Platform removes record contents from diagnostic data before it leaves the customer's environment. Usage Data may include limited personal information about Authorized Users, such as a user ID or email address, and the IP address of the deployment. We use Usage Data to provide, support, secure and license the Platform, and to analyze, develop and improve our products and services.

When receiving other Golten Offerings: When we provide implementation, training or professional services, we keep records of the services we provide and the people who take part, such as the names of training attendees and the contacts who request or approve work.

3. Information We Receive from Third Parties

We may receive information about you from other sources and combine it with information we already hold. These sources include public websites and professional networks, business and marketing partners, resellers and referral partners, data and lead-enrichment providers, and security and fraud-prevention services. For example, a partner may refer you to us when you express interest in Golten, or a data provider may give us your current job title and company.

4. Third-Party Applications

This Notice applies to information collected through the Sites and the Golten Offerings. The Sites may link to, or embed features from, third-party websites, applications and services, such as scheduling tools, video players, web fonts and content delivery networks. When you interact with those third parties, their own terms and privacy notices apply to the information they collect, not this Notice. We encourage you to read them.

5. Analytics and Targeted Online Advertisements

The Sites support two optional categories of cookies and similar technologies: Analytics and Marketing. Both are off by default. They are only turned on if you opt in, either through the cookie settings pop-up shown when you first visit the Sites or on our Cookie Preferences page. Scripts in these categories do not load until you opt in.

Analytics. If you allow analytics cookies, analytics providers working for us may collect information about your visit, such as the pages you view, how you arrived at the Sites, your device and browser type, your IP address and your approximate location. We use this information to understand how the Sites are used and to improve them.

Marketing. If you allow marketing cookies, our advertising partners, such as social media platforms and advertising networks, may use cookies, pixels, tags and similar technologies to collect information such as your IP address, browser type, the pages you view and how you interact with the Sites. They use this information to measure the effectiveness of our campaigns and to show you Golten advertising on other websites based on your interests. Under some U.S. state privacy laws, this may be considered "sharing" of personal information for cross-context behavioral advertising, or "targeted advertising."

Current providers. As of the "Last Updated" date of this Notice, Golten has not enabled any analytics or marketing providers on the Sites. Before we enable one, we will list it, along with the cookies it uses, on our Cookie Preferences page.

Your choices. You can withdraw or change your consent at any time on our Cookie Preferences page. If your browser sends a Global Privacy Control signal, we automatically turn off marketing cookies for that browser and do not let them be turned on, as described in Section 12. This Notice does not cover cookies, pixels or similar technologies used in advertisements that third parties deliver on other websites.

6. Use of Information We Collect

We use the personal information we collect for the following purposes:

• to operate, maintain, secure and improve the Sites and the Golten Offerings;
• to respond to demo requests, questions and other enquiries, and to schedule and run product evaluations;
• to provide the Golten Offerings you or your organization request, including implementation, training and support;
• to send technical notices, updates, security alerts and administrative messages;
• to manage customer and partner accounts, contracts, invoicing and collections;
• to protect the security of our systems and the Golten Offerings, verify identity and access, and detect and prevent fraud, spam, malware and other abuse;
• to find and fix bugs and errors, and to maintain the quality and safety of our products;
• to carry out research and development, and to understand how the Sites and Golten Offerings are used, including through analytics, surveys and feedback;
• to send marketing and promotional communications about Golten products and services, in line with your communication preferences;
• to combine information we receive from third parties with information we hold, to better understand your organization's needs;
• for short-term, transient purposes, such as tailoring the content you see during a visit;
• to comply with law, regulation and legal process, and to establish, exercise and defend legal claims; and
• for any other purpose we describe to you when we collect the information, or with your consent.

We may use automated tools, including analytics and machine learning tools, to carry out these purposes. We do not use personal information collected through the Sites to train generative AI models. Golten never uses Customer Data to train its models. We will not use personal information for purposes that are materially different from, unrelated to, or incompatible with those described in this Notice without first telling you.

7. Sharing of Personal Information

We do not share personal information with third parties except as described below:

• De-identified information. We may share information that has been aggregated, de-identified or anonymized so that it can no longer reasonably be linked to you.
• At your direction or with your consent. We share information when you ask us to or agree that we may.
• Affiliates. We may share information with companies under common ownership or control with Golten, which will handle it in line with this Notice.
• Service providers. We share information with vendors that process it on our behalf under written contracts, such as providers of website hosting, customer relationship management, email delivery, analytics, scheduling, video conferencing, billing, security and customer support.
• Analytics and advertising partners. If you opt in to analytics or marketing cookies, we share information collected through those technologies with the analytics providers and advertising partners described in Section 5. You can withdraw your consent at any time on our Cookie Preferences page.
• Business partners. We may share information with resellers, referral partners, systems integrators and technology partners to respond to your requests and to provide you with information about Golten. If you buy or express interest in an offering we provide together with a partner, we may share relevant information with that partner. Where you have agreed, partners may also send you marketing about their own products. We do not control how partners use information under their own privacy notices.
• Legal and safety. We may disclose information where we believe in good faith that it is required by law, regulation or legal process, including a lawful request from public authorities, or is needed to protect the rights, property or safety of Golten, our customers or others, or to protect any person's vital interests.
• Business transfers. We may share information in connection with, or during negotiations of, a merger, acquisition, financing, reorganization, sale of assets or similar transaction involving all or part of our business.

Golten does not sell personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

8. Security of Your Personal Information

We use reasonable and appropriate technical and organizational measures designed to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration and destruction. These include encryption in transit and at rest, access controls based on least privilege, multi-factor authentication for our systems, network monitoring, and logging. Our personnel are bound by confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International Data Transfers

Golten is based in the United States, and the personal information described in this Notice is mainly stored and processed in the United States. Our affiliates, partners and service providers may process it in other countries. Those countries may have data protection laws that differ from, and in some cases are less protective than, the laws where you live.

10. Your Information Choices and Changes

You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email we send, or by contacting us at privacy@golten.ai. If you opt out, we may still send you non-promotional messages, such as messages about your account, an active evaluation or your organization's contract with us. For your other privacy rights, see Section 12.

11. California Users and Notice at Collection

This section gives California residents the information required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"). Golten does not sell personal information, as "sell" is defined in the CCPA and its regulations.

Sharing for cross-context behavioral advertising. In the preceding 12 months, Golten has not shared personal information for cross-context behavioral advertising. If you opt in to marketing cookies after we enable an advertising partner, that partner may receive identifiers (such as your IP address and cookie identifiers), internet or other network activity, and inferences drawn from them, so that it can show you Golten advertising on other websites. We will update this section with the categories shared and the recipients before any such sharing begins. You can opt out at any time on our Cookie Preferences page or by using Global Privacy Control, as described in Sections 5 and 12.

Sensitive personal information. Golten does not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

Sources, purposes and retention. We collect personal information from the sources described in Sections 1, 2 and 3, for the business and commercial purposes described in Section 6, and we keep it for the periods described in Section 14. Your rights under the CCPA, and how to exercise them, are described in Section 12.

12. Your Privacy Rights

Depending on where you live, and subject to applicable law, you may have the following rights:

• Access, correction and deletion. You may ask us for a copy of your personal information, or ask us to correct, update or delete it.
• Right to know. You may ask us to tell you the categories of personal information we collect about you, the categories of sources, our business or commercial purposes, and the categories of third parties to which we disclose it.
• Objection, restriction and portability. You may object to our processing of your personal information, ask us to restrict it, or ask to receive it in a portable format.
• Withdrawal of consent. Where we process your personal information based on your consent, you may withdraw it at any time. This does not affect processing we carried out before you withdrew.
• Opt-out rights. You may opt out of the sale of your personal information, its sharing for cross-context behavioral advertising, targeted advertising, and certain profiling, and you may ask us to limit the use of sensitive personal information. Golten does not currently sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information beyond what the law permits.
• Appeal. If we decline to act on your request, you may appeal our decision by replying to our response or by contacting us using the details in Section 16.
• Complaints. You may complain to us at privacy@golten.ai.

Cookies and Global Privacy Control. You can block or delete cookies through your browser settings or on our Cookie Preferences page. We treat a legally recognized browser opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of sales and sharing for the browser or device that sends it.

How to submit a request. Submit our privacy request form, or email us at privacy@golten.ai. To protect your information, we will check that the details you give us, such as your name, email address, company and country or state of residence, match the information we hold before acting on your request.

Authorized agents. You may use an authorized agent to submit a request for you. We will ask the agent for proof that you gave them signed permission, and we may still ask you to confirm your identity directly with us.

Non-discrimination. We will not discriminate against you for exercising any of your privacy rights. We do not offer financial incentives in exchange for collecting or using personal information.

Children. The Sites and the Golten Offerings are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, please contact us at privacy@golten.ai with "Child Data" in the subject line, and we will delete it.

13. Your Privacy Rights in Respect of Customer Data

If your personal information is part of Customer Data, for example because you are a customer of a bank that uses the Platform to manage its records, that organization controls your information and is responsible for responding to your requests. To access, correct, amend, delete or port that information, please contact the organization directly and refer to its privacy notice. If you contact Golten instead, we will refer you to the organization where we can identify it, and we will help our customer respond as required by the Customer Agreement.

14. Data Retention and Deletion

We keep personal information for as long as we have an ongoing legitimate business need to do so. For example, we keep it while we have a business relationship with you or your organization, to provide services you request, and to comply with legal, tax and accounting requirements, resolve disputes, and enforce our agreements.

How long we keep particular information depends on factors such as who provided it, why we collected it, how sensitive it is, and our business need for it. Prospect and demo-request information is generally kept for up to 24 months after our last interaction. When we no longer have a legitimate business need for personal information, we delete or anonymize it. If that is not possible, for example because the information is held in backup archives, we store it securely and isolate it from any further processing until it can be deleted.

Customer Data is retained and deleted by the customer in its own environment, and as set out in the Customer Agreement.

15. Changes to this Notice

We may update this Notice from time to time to reflect changes in our practices or in the law. When we do, we will change the "Last Updated" date at the top of this page. If we make material changes, we will give you additional notice, such as a statement on the Sites' home page or an email to you.

16. How to Contact Us

If you have any questions or concerns about this Notice or our privacy practices, or want to exercise your rights, please submit our privacy request form or contact us:

Golten, Inc.
Attn: Privacy
10850 Providence Rd, #1306
Charlotte, NC 28277
Email: privacy@golten.ai