Privacy Notice for Invited Pilot

Effective date: August 8, 2026

Business: ShilohIQ LLC, a Kansas limited liability company

Privacy inquiries: hello@shilohiq.com

1. Scope

This Privacy Notice explains how ShilohIQ LLC (ShilohIQ, we, us, or our) collects, uses, discloses, and protects personal information in connection with the limited Enterprise Learning OS invited pilot.

This notice applies to invited pilot users, customer contacts, administrators, support contacts, and other people whose personal information is processed in connection with the pilot. It does not authorize broad production processing or collection of every data type represented in the application schema.

Depending on the context and applicable law, ShilohIQ may act as a business/controller for account, security, administrative, and support information and may process Customer Content on behalf of an invited organization under its instructions. A separate written agreement controls if it establishes different legally required roles or instructions.

2. Personal information we may collect

Depending on the approved pilot configuration and how you use the Service, we may collect:

• Account and identity information: email address, display name, account identifiers, subject identifiers, account status, authentication events, and invitation information.
• Organization and authorization information: tenant, organization, workspace, membership, role, permission, and administrative records.
• Profile information: instructor, learner, reviewer, administrator, or customer-contact profile information that is approved for the pilot.
• Customer Content and learning information: knowledge assets, programs, courses, modules, lessons, assessments, rubrics, imports, stored assets, exports, and related information submitted by an authorized user.
• Activity information: progress, attempts, completions, timestamps, workflow events, and other approved usage records.
• Support and communications information: support requests, messages, feedback, notification preferences, and customer-service records.
• Technical, security, and operational information: log records, device or browser information made available through normal web requests, authorization and audit events, validation results, deployment and health records, security events, and incident evidence.
• Privacy and compliance records: consent records, privacy requests, processing records, retention actions, or assessment records when those functions are approved and used.

The presence of a field or model in the software does not mean that information is actively collected or approved for the invited pilot.

3. Sources of personal information

We may receive personal information:

• directly from you;
• from the organization that invites or administers your account;
• from authorized users who submit Customer Content;
• automatically through normal operation, authentication, security, logging, and support functions; and
• from service providers acting for ShilohIQ when necessary to operate or secure the pilot.

4. How we use personal information

We may use personal information to:

• provision, authenticate, administer, and secure invited accounts;
• enforce tenant, organization, workspace, role, and permission boundaries;
• provide, operate, support, troubleshoot, maintain, and evaluate approved pilot functions;
• process, validate, compile, store, and export learning materials and Customer Content as directed by authorized users;
• detect, investigate, prevent, and respond to security incidents, fraud, abuse, or unauthorized access;
• maintain audit, reliability, deployment, backup, recovery, and operational records;
• communicate about the pilot, support requests, service changes, incidents, or administrative matters;
• respond to privacy, account, and support requests;
• improve reliability, usability, security, and approved pilot functionality; and
• comply with applicable law, legal process, contractual obligations, and enforceable requests.

We do not use the invited pilot for automated consequential decisions about individuals.

5. Sensitive and prohibited data

The invited pilot is designed to use only the minimum information reasonably necessary for controlled evaluation.

Unless ShilohIQ expressly approves a data category and its required safeguards in writing, do not submit:

• children's personal information;
• protected health or medical information;
• financial-account or payment-card information;
• Social Security numbers, passport numbers, driver's-license numbers, or other government identifiers;
• biometric identifiers or templates;
• precise location information unrelated to pilot operation;
• highly sensitive employment records;
• information subject to a specialized regulatory regime that has not been expressly approved; or
• confidential third-party information you are not authorized to provide.

6. Cookies and similar technologies

The Service may use session, authentication, security, and similar browser technologies that are reasonably necessary to sign users in, maintain authorized sessions, protect the Service, and provide requested functionality.

The invited-pilot codebase is not configured with advertising pixels or behavioral-advertising analytics integrations. If ShilohIQ later introduces non-essential tracking or advertising technology, this Privacy Notice and any required consent or opt-out mechanism must be updated before that change is used for the pilot.

7. How we disclose personal information

We may disclose personal information only as reasonably necessary for the purposes described in this notice, including to:

• Service providers and subprocessors that host, secure, maintain, support, or operate the Service under applicable contractual or confidentiality obligations.
• Your organization and authorized administrators when necessary to administer accounts, roles, workspaces, Customer Content, security, or the organization's pilot participation.
• Professional advisers such as legal, security, insurance, accounting, or audit advisers when reasonably necessary and subject to appropriate duties of confidentiality.
• Government, law-enforcement, or legal recipients when required by applicable law, legal process, or a valid enforceable request, or when reasonably necessary to protect rights, safety, users, or systems.
• A successor or transaction participant in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of relevant assets, subject to applicable law and appropriate confidentiality protections.

For the invited pilot, ShilohIQ does not sell personal information for monetary consideration and the Service is not configured for targeted advertising.

8. Service-provider boundary

The current invited-pilot infrastructure includes:

• Supabase for hosted database and authentication;
• Vercel for customer and administrator web applications;
• Render for the API service; and
• GitHub for source control, CI, deployment evidence, and controlled project records.

Customer billing and Stripe activation are not enabled for this release. Live external AI is not enabled for this release.

Service-provider, region, or processing arrangements may change over time. Material changes to the approved provider boundary require the applicable project review and release controls before use.

9. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this notice, including the duration of the pilot and account relationship, support and security needs, contractual obligations, dispute resolution, legal requirements, and documented backup and recovery processes.

When information is no longer reasonably necessary, we will delete, anonymize, or otherwise dispose of it in accordance with applicable law and documented operational processes. Deletion from active systems may not immediately remove information from encrypted backups or security records that are retained for a limited period and protected from ordinary use.

An invited organization may have additional return, export, deletion, or retention terms in a written pilot agreement. Those terms control where applicable.

10. Security

We use administrative and technical safeguards designed to protect personal information, including authentication, authorization, tenant isolation, row-level security where applicable, secure deployment practices, secret-hygiene controls, approved-origin controls, monitoring, and backup/recovery processes.

No system or transmission method is completely secure. We therefore cannot guarantee absolute security. Suspected security incidents should be reported to support@shilohiq.com.

11. Your privacy choices and rights

Depending on where you live and the law that applies, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, or to obtain information about how it is used or disclosed. Some laws may also provide rights to opt out of certain processing or to appeal a privacy-request decision.

To make a privacy request, contact hello@shilohiq.com. We may need to verify your identity and authority before completing a request. If your information is controlled by the organization that invited you, we may direct your request to that organization or assist it as required by applicable law or contract.

We will not discriminate against a person for exercising a privacy right protected by applicable law.

If applicable law permits use of an authorized agent, we may request reasonable evidence of the agent's authority and may separately verify the request with the individual.

12. Children

The invited pilot is not directed to children under 13 and is not approved for direct use by children. ShilohIQ does not knowingly authorize collection of personal information directly from children under 13 through the invited pilot.

If we learn that children's personal information was submitted outside the approved scope, we will take reasonable steps to investigate and delete or otherwise address it as required by applicable law.

Organizations participating in the pilot must not submit children's personal information unless a later written approval establishes the appropriate legal basis, notices, consent process, contractual terms, and technical safeguards.

13. International processing

ShilohIQ and its service providers may process information in the United States and other locations where they operate. If applicable law requires a transfer mechanism or additional safeguards for a particular user population, those requirements must be implemented before that processing is approved.

14. Legal and safety disclosures

We may preserve or disclose information when reasonably necessary to comply with law or legal process; protect the rights, property, or safety of ShilohIQ, users, or others; investigate fraud, abuse, or security incidents; enforce agreements; or establish, exercise, or defend legal claims.

15. Changes to this Privacy Notice

We may update this Privacy Notice as the pilot or applicable requirements change. The effective date will identify the current published version. If a change materially affects how personal information is collected, used, or disclosed, we will provide reasonable notice when required by law.

Material changes to permitted data categories, live-AI status, public signup, billing, provider scope, or the intended user population remain subject to the project's applicable review and release gates.

16. Contact

Privacy inquiries and privacy-rights requests: hello@shilohiq.com

Support and security reports: support@shilohiq.com

ShilohIQ may provide an additional business correspondence address through secure business records or direct notice when required for a particular legal or contractual purpose.