Information Security Policy

1. Purpose

This Information Security Policy ("Policy") establishes the principles, requirements, and responsibilities governing the protection of information assets at GetReviews Ventures, LLC, operating as GetReviews.ai ("the Company"). The Company provides a software-as-a-service platform that enables e-commerce merchants to collect, manage, and analyze customer reviews across integrated online marketplaces and storefronts.

The purpose of this Policy is to:

• Protect the confidentiality, integrity, and availability of all data processed by or on behalf of the Company
• Establish clear responsibilities for information security across the organization
• Ensure compliance with applicable laws, regulations, and contractual obligations
• Provide a foundation for consistent, repeatable security practices across all Company systems and operations
• Communicate our security commitments to merchants, users, partners, and regulators

2. Scope

This Policy applies to:

• All GetReviews.ai employees, officers, contractors, consultants, and temporary personnel
• All third-party service providers and vendors who access, process, store, or transmit Company or customer data
• All information systems, applications, infrastructure, and networks owned, operated, or managed by the Company
• All data collected, processed, transmitted, or stored in connection with the Company's Service, regardless of format or location

This Policy covers the complete data lifecycle, including collection, processing, storage, transmission, archival, and secure deletion.

3. Governance & Organizational Responsibility

3.1 Security Ownership

The Company designates a Security Officer responsible for:

• Maintaining, updating, and enforcing this Policy
• Overseeing day-to-day security operations and risk management
• Coordinating incident response
• Ensuring ongoing compliance with applicable regulations and partner requirements
• Reporting on the security posture to executive leadership

The Security Officer reports directly to executive leadership and has the authority to implement necessary security controls across the organization.

3.2 Employee Responsibilities

All personnel are responsible for:

• Reading, understanding, and complying with this Policy
• Completing mandatory security training upon hire and annually thereafter
• Promptly reporting suspected security incidents, policy violations, or vulnerabilities to the Security Officer
• Protecting credentials and access rights assigned to them
• Using Company systems and data only for authorized business purposes

3.3 Policy Review & Maintenance

This Policy is reviewed at a minimum annually and updated whenever any of the following occur:

• Material changes to the Company's systems, architecture, or data processing activities
• New regulatory or contractual requirements
• Significant security incidents
• Material changes to the Company's business operations or integrations

All revisions are documented with version numbers and effective dates. Personnel are notified of material changes within 7 business days of publication.

4. Data Classification & Inventory

4.1 Classification Tiers

The Company classifies all information assets into the following tiers, each carrying defined handling requirements:

4.2 Data Categories Processed

In the course of providing its Service, the Company processes the following categories of data:

• Merchant account data: contact information, business details, login credentials
• Consumer personal data: names, email addresses, and purchase-related information submitted through integrated storefronts
• Usage and diagnostic data: IP addresses, browser type, session duration, device identifiers
• API and integration data: credentials, tokens, and data exchanged with third-party marketplace integrations
• Anonymized analytics: aggregated, de-identified statistics used for service improvement

4.3 Data Minimization

The Company collects only the personal data necessary to provide the requested Service. We do not collect sensitive special categories of personal data (such as health, financial account, or biometric data) unless expressly required and disclosed. Data collection practices are reviewed periodically to ensure ongoing adherence to the principle of minimization.

5. Access Control

5.1 Least Privilege

Access to systems, databases, and data is granted on a need-to-know, least-privilege basis. Employees and contractors receive only the access required to perform their specific job functions. Access rights are formally requested, approved, and documented before provisioning.

5.2 Role-Based Access Control

Role-based access control (RBAC) is implemented across all production systems. Access roles and permissions are reviewed quarterly. Access is revoked immediately upon employee termination, contractor engagement end, or role change. Quarterly audits confirm that active access rights align with current job responsibilities.

5.3 Authentication Standards

• All accounts accessing internal systems must use strong, unique passwords meeting defined complexity requirements
• Multi-factor authentication (MFA) is mandatory for all administrative access, production system access, and remote access
• Shared or generic accounts are prohibited in production environments
• API keys, tokens, and secrets are stored in an encrypted secrets management system, rotated on a defined schedule, and revoked immediately upon suspected compromise
• Default credentials on any system or application must be changed prior to deployment

5.4 Third-Party & Vendor Access

Third parties requiring access to Company systems or data must:

• Execute a formal data processing agreement or equivalent contract before any access is granted
• Be granted only the minimum access necessary for their specific function
• Adhere to security standards equivalent to those in this Policy
• Have their access reviewed annually and revoked when no longer needed

6. Data Protection & Encryption

6.1 Encryption in Transit

All data transmitted between end users and the Company's platform, and between the Company's systems and third-party integrations, is encrypted using TLS 1.2 or higher. Transmission of personal or confidential data over unencrypted channels is prohibited.

6.2 Encryption at Rest

All personal data and confidential data stored in Company systems is encrypted at rest using AES-256 or equivalent industry-standard encryption. Database backups are encrypted using the same standard. Encryption keys are managed through a dedicated key management process with access controls and rotation schedules.

6.3 Data Retention

Personal data is retained only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law or contract. Retention periods by data category are defined in the Company's Data Retention Schedule. Upon expiration of the applicable retention period or upon receipt of a valid deletion request, data is securely deleted from all primary and backup systems in the ordinary course of business.

6.4 Data Disposal

When data reaches the end of its retention period or must be deleted upon request, it is disposed of using methods appropriate to the sensitivity of the data. Electronic data is deleted in a manner that prevents recovery. Physical media containing sensitive data is destroyed using industry-accepted methods prior to disposal or repurposing.

7. Network & Infrastructure Security

7.1 Infrastructure Security

• Production infrastructure is hosted on cloud providers with recognized security certifications (e.g., SOC 2 Type II, ISO 27001)
• Network segmentation separates production environments from development, testing, and staging environments
• Firewalls and network access controls restrict inbound and outbound traffic to authorized sources and ports
• Regular vulnerability scanning is conducted across all production systems
• Patch management procedures ensure critical security patches are applied within defined timeframes based on severity

7.2 Application Security

• The Company follows a Secure Software Development Lifecycle (SSDLC) for all product development
• Security review is a required component of code review prior to production deployment
• Web application firewall (WAF) protections are implemented on all customer-facing applications
• API endpoints are authenticated and rate-limited to prevent unauthorized access and abuse
• Input validation and output encoding are applied consistently to prevent injection and cross-site scripting vulnerabilities
• Third-party dependencies are monitored for known vulnerabilities and updated on a regular basis

7.3 Logging & Monitoring

Comprehensive audit logging is maintained for all access to systems containing personal or confidential data. Logs are:

• Retained for a minimum of 12 months
• Protected against unauthorized modification or deletion
• Monitored regularly for anomalous or suspicious activity
• Available for use in incident investigation and regulatory compliance purposes

Security alerts are triaged and investigated according to defined severity levels and response timeframes.

8. Incident Response

8.1 Incident Response Plan

The Company maintains a formal Incident Response Plan (IRP) covering detection, containment, eradication, recovery, and post-incident review. The IRP is tested at minimum annually through tabletop exercises or simulated drills. Lessons learned from exercises and actual incidents are incorporated into plan updates.

8.2 Incident Classification

8.3 Breach Notification

In the event of a personal data breach, the Company will:

• Notify affected individuals and relevant regulatory authorities in accordance with applicable law (including within 72 hours under GDPR where applicable)
• Notify affected merchants and partners promptly upon confirmation of any incident involving their data
• Include in notifications: the nature of the incident, data categories affected, likely consequences, and remediation measures taken or proposed

Incident records and post-incident reports are documented and retained for a minimum of three years.

9. Third-Party & Vendor Management

9.1 Vendor Security Due Diligence

Prior to engaging any vendor or service provider that will access, process, store, or transmit Company or customer data, the Company conducts security due diligence. This review includes assessment of the vendor's security posture, certifications, and data handling practices. Vendors must execute a Data Processing Agreement (DPA) or equivalent data protection contract before any data is shared.

9.2 Ongoing Vendor Oversight

Vendor relationships involving access to personal or confidential data are reviewed at minimum annually. The review confirms that the vendor's security practices remain adequate and that their access remains necessary. Vendors who fail to meet required standards are remediated or offboarded.

9.3 Sub-Processors

The Company may engage sub-processors to support delivery of its Service. All sub-processors are contractually bound to data protection obligations equivalent to those applicable to the Company. A list of sub-processors is available to merchants upon written request directed to support@getreviews.ai.

10. Privacy & Individual Rights

10.1 Privacy by Design

Privacy considerations are incorporated into system design, product development, and data processing decisions from the outset. The Company's Privacy Policy, available at https://getreviews.ai/privacy, describes in detail the types of personal data collected, the purposes for which it is processed, and the rights available to individuals.

10.2 Individual Rights

The Company supports the following individual rights in accordance with applicable privacy law, including GDPR and CCPA/CPRA:

• Right of Access — request a copy of personal data held by the Company
• Right to Rectification — request correction of inaccurate or incomplete personal data
• Right to Erasure — request deletion of personal data, subject to applicable legal retention obligations
• Right to Restriction — request that processing be restricted in defined circumstances
• Right to Data Portability — receive personal data in a structured, commonly used, machine-readable format
• Right to Object — object to processing based on legitimate interests or for direct marketing purposes

Requests to exercise any of the above rights may be submitted to support@getreviews.ai. The Company responds to all verified requests within 30 days, or sooner as required by applicable law.

10.3 Children's Privacy

The Company's Service is not directed at children under the age of 13. The Company does not knowingly collect personal data from children under 13. If the Company becomes aware that personal data from a child under 13 has been collected without verifiable parental consent, it will take prompt steps to delete such data from its systems.

10.4 Cross-Border Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) or Switzerland to a jurisdiction not recognized by the European Commission as providing an adequate level of data protection, the Company ensures that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms. The Company's Data Processing Addendum, available at https://getreviews.ai/dpa, governs such transfers for merchant data subject to GDPR.

11. Cookies & Tracking Technologies

The Company uses cookies and similar tracking technologies (including web beacons and pixel tags) on its website and platform. Three categories of cookies are deployed:

• Essential / Session Cookies — required for authentication and basic platform functionality; cannot be disabled without loss of service
• Preference / Functionality Cookies — remember user settings and preferences to provide a more personalized experience
• Analytics Cookies — collect anonymized usage data to support service improvement; no behavioral advertising cookies are deployed

Users may manage cookie preferences through their browser settings. The Company's full Cookie Policy is incorporated within the Privacy Policy at https://getreviews.ai/privacy.

12. Physical & Environmental Security

The Company operates as a cloud-native organization. Production systems are hosted in data centers operated by reputable cloud infrastructure providers that maintain the following physical controls:

• 24/7 physical access controls, surveillance, and intrusion detection
• Environmental controls including fire suppression, climate management, and power redundancy
• Recognized security certifications such as SOC 2 Type II and/or ISO 27001

For Company office and remote work environments, a Clean Desk Policy is in effect. Employees are prohibited from storing personal or confidential data on unmanaged personal devices or unauthorized cloud storage services. Laptops and mobile devices used for Company work are subject to device management and must use full-disk encryption.

13. Business Continuity & Disaster Recovery

The Company maintains Business Continuity and Disaster Recovery (BCDR) plans to ensure the protection and availability of data and services in the event of system failure, natural disaster, or other disruption. Key controls include:

• Regular automated backups of all production data, encrypted and stored in geographically redundant locations
• Defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) appropriate to each system's criticality
• Failover and redundancy mechanisms for critical infrastructure components
• Periodic testing of backup restoration procedures to confirm recoverability
• Annual testing of the BCDR plan through tabletop exercises or live drills

14. Regulatory & Legal Compliance

The Company maintains compliance with all applicable data protection laws and regulations. Applicable frameworks include, but are not limited to:

• General Data Protection Regulation (GDPR) — applicable to data subjects in the EU and EEA
• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) — applicable to California residents
• Other applicable U.S. state privacy laws as enacted
• Applicable sector-specific and marketplace partner security requirements

The Company's Security Officer monitors regulatory developments and updates policies and practices accordingly. Compliance is an ongoing program, not a one-time exercise.

Where the Company acts as a data processor on behalf of merchants, the terms of the Data Processing Addendum (DPA) at https://getreviews.ai/dpa govern such processing and are incorporated by reference into the Company's Terms of Service.

15. Policy Enforcement

Compliance with this Policy is mandatory for all personnel and covered third parties. Violations are taken seriously and are subject to:

• Disciplinary action up to and including termination of employment or contractor engagement
• Termination of third-party vendor or partner agreements
• Civil or criminal referral where violations involve illegal activity

Personnel who become aware of a suspected policy violation are obligated to report it to the Security Officer promptly. Reports may be made confidentially. Retaliation against individuals who report security concerns in good faith is prohibited.

16. Related Documents & Resources

This Policy should be read in conjunction with the following Company documents, all of which are publicly available at https://getreviews.ai:

• Privacy Policy — https://getreviews.ai/privacy
• Terms of Service — https://getreviews.ai/terms
• Cookie Policy — incorporated within the Privacy Policy