To Satisfy Our Legal Obligations. We use your Personal Data to comply with applicable law and respond to lawful requests and communications from law enforcement authorities and other government officials (Legal Obligations).

To Maintain Security and Prevent Fraud. We use your Personal Data to help monitor and maintain the security and integrity of the Website as well as our systems and networks (Legitimate Interests; Legal Obligations).

As Otherwise Permitted, Necessary, or Appropriate. We use your Personal Data as otherwise described in this Privacy Policy or as explained to you at the point of data collection. We will also use your Personal Data at your direction or with your consent. Finally, we will use your Personal Data as we believe necessary or appropriate to protect our rights, privacy, safety, property, and/or those of others (Consent; Legitimate Interests; Vital Interests).

To Provide and Improve the Services Using AI Technologies. We may use Personal Data to operate, support, and improve the functionality of our System to generate outputs and enhance system performance. We do not use Personal Data contained in Customer Data to train or improve generalized or third-party artificial intelligence or machine learning models. To the extent we use Personal Data to improve our Services, such use is limited to internal purposes such as debugging, performance monitoring, and developing features.

Hebbia does not currently sell your personal information for monetary consideration. To the extent that any disclosure of your personal information may constitute a "sale" or "share" under applicable U.S. privacy laws (including transfers for cross-context behavioral advertising), you have the right to opt out at any time. You may exercise this right by selecting "Do Not Sell or Share My Personal Information" through our cookie preferences (available at the bottom of Hebbia.com or in the cookie consent banner) or by submitting a request through our DSAR form at Hebbia Subject Access Request Form . We share personal information only with subprocessors who are essential to facilitating the delivery of our services. A complete and current list of these third-party subprocessors, including their functions and locations, is maintained in our Data Processing Agreement (DPA), available at hebbia.com/dpa.

We may also gather aggregated data about our services and website visitors for internal analytics, reporting, and improving our Services, and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for marketing or promotional purposes.

The personal information Hebbia collects is stored in virtual resources hosted by third-party service providers. These data storage locations are restricted to the authorized geographic regions set forth in our DPA, available at hebbia.com/dpa . These third parties are contractually prohibited from accessing or using your personal information for any purpose other than providing the specific processing activities outlined in our DPA.