PRIVACY POLICY

Last modified: July 1, 2026

INTRODUCTION

EXPRESSIVE VOICE ASSISTANT LABORATORIES, INC. and our affiliates and subsidiaries ("Company" or "We") respect your privacy and are committed to protecting it by complying with this policy (our "Policy"). This Policy applies to information we collect when you access or use our websites, social media platforms or any Kova related product or service (collectively, the "Kova AI Solutions").

This Policy describes:

• How we collect, use, disclose, and protect the personal information of our customers, website and our Kova AI Solutions users ("you").
• Describes the types of information we may collect from you or that you may provide when you visit the website www.kova.ai (our "Website"), or when you download, install, register with and use the Kova Audiobooks mobile application accessible at the App Store (our "App") or when you register, access and use any of the Kova Text-to-Speech services at Kova TTS (our "Kova AI Services").
• Our practices for collecting, using, maintaining, protecting, and disclosing that information.

We will only use your personal information in accordance with this Policy unless otherwise required by applicable law. We take steps to ensure that the personal information that we collect about you is adequate, relevant, not excessive, and used for limited purposes.

PERSONAL INFORMATION

The term "personal information" refers to any information which relates to a natural person and makes it possible, directly or indirectly, to identify that person. It should be noted that our Policy does not generally apply to the collection and confidentiality of information related to an individual's performance of his or her duties within an organization, such as name, title, or position, as well as the address, e-mail address and telephone number associated with his or her place of employment, but we handle such information at all times in strict compliance with applicable law. During your relationship with the Company, you may be asked to provide certain personal information concerning you and/or other individuals.

OUR POLICY REGARDING PERSONAL INFORMATION

Please read this Policy carefully to understand our policies and practices for collecting, processing, and storing your information. If you do not agree with our policies and practices, do not download, register with, or use any of the Kova AI Solutions. By downloading, registering with, accessing, or using the Kova AI Solutions, you acknowledge that you have read and understood this Privacy Policy. Where applicable law requires consent, including for non-essential cookies, analytics, IDFA-based tracking, targeted advertising, or other optional processing activities, we will request your consent separately or provide the privacy choices required by law. This Policy may change from time to time (see CHANGES TO OUR PRIVACY POLICY, below). Your continued use of the Kova AI Solutions after an updated Privacy Policy becomes effective means that the updated Policy applies to your use of the Kova AI Solutions from that point forward, subject to any consent rights, opt-out rights, or other rights you may have under applicable law. If a change requires your consent under applicable law, we will seek that consent before applying the change to you.

CHILDREN AND MINORS

The Kova AI Solutions are not directed to, and are not intended for use by, individuals under 18 years of age. No individual under 18 may create an account, make purchases, use the Kova AI Solutions, or provide personal information to us unless we have expressly authorized such use and obtained any consent required by applicable law.

We do not knowingly collect personal information from individuals under 18. We also do not knowingly use or disclose personal information of individuals under 18 for targeted advertising, retargeting, cross-context behavioural advertising, sale, sharing, or custom audience advertising.

In the United States, if we learn that we have collected personal information from a child under 13 in circumstances where the Children's Online Privacy Protection Act applies, we will delete that information or obtain verifiable parental consent as required by law.

Also, if we learn that a user is under 18, we will disable targeted advertising, retargeting, sale, sharing, custom audience advertising, and IDFA-based advertising for that user, and we will take reasonable steps to delete the information or obtain any consent required by applicable law.

In Quebec, we do not knowingly collect personal information from a minor under 14 without the consent of the person having parental authority or the tutor, unless collection is clearly for the minor's benefit.

If you believe that we have collected personal information from a child or minor in violation of this Policy, please contact us at privacy@evalabs.ai. If we learn that we have collected such information without required consent, we will take reasonable steps to delete it.

PURPOSES FOR WHICH WE COLLECT PERSONAL INFORMATION

The Company uses, collects, holds, and communicates personal information for the purposes identified at the time of collection, or as otherwise permitted or required by applicable law, including for the following purposes:

• To provide our Kova AI Solutions, and other related services, and to process payments and billing for them;
• To enable you to create, personalize, download, store, export and, where you choose, share AI-generated audio content through the App, such as audiobooks, text scripts, and other synthetic audio files generated using our synthetic voice models and related technology, collectively "Audio Assets", including when you choose to upload or make such Audio Assets available on third-party platforms such as YouTube, podcast platforms, social-media services, video or audio streaming services and similar distribution channels, in accordance with our General Terms and Conditions of Use. For clarity, Kova does not collect or process user voice recordings, voice samples, voiceprints, voice embeddings, or biometric data to create Audio Assets. Audio Assets are generated from text or other permitted inputs, not from a recording of your voice. We do not use user uploads, prompts, scripts, Audio Assets, or generated content to train, fine-tune, evaluate, improve, or benchmark Kova's models or third-party models.
• To establish and manage client and service provider relationships, including considering whether to establish a relationship;
• To reply to information enquiries made through the Website or App and ensure appropriate follow-ups;
• To send updates regarding our services, and those of our affiliates, or on our App, when applicable;
• To manage our human resources;
• Administrative, management and business purposes, such as to issue invoices, administer accounts, sales, collect and process payments;
• Any other purpose for which you have consented.

INFORMATION ABOUT EMPLOYEES AND JOB APPLICANTS

In the course of its activities as an employer, the Company collects, uses and discloses personal information. For our employees, this collection falls within the essential management of labor relations. As for job applicants, their information is collected and used to assess their suitability for available positions, which may involve information obtained from third parties for background checks or professional references. If an applicant is not selected, his or her information is retained for a reasonable period of time for future opportunities, if applicable, unless a request for deletion is made. In addition, we maintain certain personal information on our former employees, including their names and contact details, for possible professional or regulatory requirements.

LIMITATION

The Company aims to limit the amount of personal information we collect to that necessary and appropriate for the identified purposes. We will not use or communicate your personal information for purposes other than those for which it was collected, except with your consent or as permitted or required by applicable law.

CONSENT

We use, hold and communicate personal information only for the purposes for which it was collected, except with the consent of the person concerned. If personal information about a third party is provided to us, the person providing the information must represent having obtained the necessary consent from that third party, or be otherwise authorized to allow us to collect, use, hold and communicate that information in accordance with this Policy. In the case of sensitive personal information, consent must be expressly provided by the individual concerned. Exceptions to this consent requirement may arise, for example, when a medical or security emergency makes it impractical to obtain consent, or when information is collected for the detection and prevention of fraud or to meet a legal obligation. For a more exhaustive list of exceptions, please contact our Privacy Officer (identified below).

WITHDRAWAL OF CONSENT

You may vary or withdraw your consent to the use and communication of your personal information, or opt-out of certain uses and communications, subject to legal and contractual restrictions. To modify or withdraw your consent, please contact our Privacy Officer (identified below).

INFORMATION WE COULD COLLECT ABOUT YOU

We could collect and use several types of information from and about you, including:

• Personal information such as name, e-mail address, payment and billing information, and IP address. Payment card information is processed by our payment processors or app platform providers; Kova does not store full payment card numbers or card security codes;
• For job applicants, work history and curriculum vitae;
• Biographical information such as job titles, name of employer;
• Personal information that you provide to us to describe your or your business needs and requirements;
• Website, Kova AI Services, and App usage and technical information, such as details of visits to our Website, use of the App, device information, IP address, pages or screens viewed, feature interactions, and information collected through cookies or similar technologies. Website analytics cookies are disabled by default unless you consent through Cookie Settings. App analytics are disabled by default unless you enable the App's Analytics setting.
• App advertising information, where authorized, such as Apple's Identifier for Advertisers, IDFA, advertising identifiers, device identifiers, App events, ad interaction data, attribution data, campaign information, and similar information used for targeted advertising, advertising measurement, frequency capping, fraud prevention, and campaign attribution. Advertising-related data collection applies only to the App and is disabled by default unless you enable the App's Advertising setting and provide any consent required by applicable law.
• Content that you provide or generate through the Kova AI Solutions, such as text inputs, prompts, scripts, generated text, synthetic audio outputs, Audio Assets, metadata associated with generated content, and related technical information necessary to provide the Kova AI Solutions. For clarity, Kova does not collect user voice recordings, voice samples, voiceprints, voice embeddings, biometric identifiers, or biometric templates.
• Any other personal information that you choose to provide to us, provided that you should not provide sensitive personal information or personal information about others unless you have the legal right to do so.

HOW WE COLLECT PERSONAL INFORMATION ABOUT YOU

We use different methods to collect your personal information, including through:

• Direct interactions with you when you provide it to us, for example, by filling in forms on our Kova AI Services platform, App, Website, or elsewhere, or corresponding with us by phone, email, when you register to receive our newsletter, or otherwise (if we have sent you a promotional email such as a newsletter, you may unsubscribe by clicking the unsubscribe link we have included in the email);
• Automated technologies or interactions, as you navigate through our Website or our App. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies;
• Third parties whom you have authorized to communicate such information to us;
• Publicly available sources.

NO VOICE, BIOMETRIC, OR SENSITIVE PERSONAL INFORMATION

Kova does not collect, request, or require users to provide voice recordings, voice samples, voiceprints, voice embeddings, biometric identifiers, biometric templates, or similar voice or biometric data. Kova does not use voice recordings, voice samples, voiceprints, voice embeddings, or biometric data to identify, authenticate, profile, or verify users.

The Kova AI Solutions may allow you to generate synthetic audio outputs, such as audiobooks, text-to-speech audio files, or other AI-generated audio content ("Audio Assets"). These Audio Assets are generated using Kova's synthetic voice technology. They are not created from your own voice recording, voice sample, voiceprint, or biometric data.

Kova does not request or intentionally collect sensitive personal information, such as government identification numbers, precise geolocation, health information, genetic information, biometric information used to identify a person, racial or ethnic origin, religious or philosophical beliefs, union membership, sexual orientation, sex-life information, or similar sensitive information. You should not provide sensitive personal information in prompts, scripts, text inputs, files, support requests, or other content unless we specifically request it and you have provided any consent required by applicable law.

If you provide sensitive personal information contrary to this Policy, or if we are required to process sensitive personal information for legal, security, fraud-prevention, or emergency purposes, we will process it only as permitted by applicable law. If we ever decide to intentionally collect sensitive personal information, we will update this Policy and obtain express consent where required by law.

IDENTIFICATION, LOCATION, AND PROFILING TECHNOLOGIES

Certain technologies used in the Kova AI Solutions may allow us or our service providers to identify, locate, or profile users, as those terms may be understood under applicable Quebec privacy law.

For example, we may use account identifiers, device identifiers, IDFA where authorized, cookies, SDKs, app events, analytics events, approximate location derived from IP address, preferences, interests, app interactions, content interactions, and similar information to:

• authenticate users and secure accounts;
• understand how the Kova AI Solutions are used;
• recommend content, formats, or features;
• measure product performance;
• provide analytics;
• conduct advertising measurement, attribution, targeted advertising, or retargeting where permitted by law and subject to your privacy choices.

Where required by Quebec law, privacy settings for technological products or services offered to the public will be configured to provide the highest level of confidentiality by default, without any intervention by the user, subject to legally permitted exceptions. Non-essential analytics, targeted advertising, retargeting, IDFA-based tracking, and similar optional privacy-impacting features will be subject to applicable consent and privacy-choice requirements.

Where required by applicable law, we will inform you of the use of these technologies and the means available to activate, deactivate, or manage them, including through App settings, Website cookie settings, Apple iOS tracking controls, or our Your Privacy Choices mechanism.

COOKIES AND WEBSITE ANALYTICS

Cookies are small text files that a website or server may place on your computer or mobile device when you visit a website. Cookies do not damage your device, but they can help websites remember preferences, support security, maintain login functionality, measure website performance, and improve the user experience.

We use the following types of cookies and similar technologies on our websites:

• Essential cookies. Essential cookies are required for our websites to work properly. They may be used for security, fraud prevention, bot detection, login functionality, remembering your cookie choices, maintaining session information, and other functions that are necessary to provide the websites. Essential cookies cannot be turned off through our Cookie Settings, although you may be able to block them through your browser settings.
• Analytics cookies. Analytics cookies and similar website analytics technologies help us understand how visitors use our websites, such as which pages are visited, how long visitors stay, whether visitors encounter errors, and how visitors interact with selected website features. Website analytics help us improve the design, functionality, performance, and reliability of our websites.

Analytics cookies are disabled by default. We use analytics cookies only if you provide consent through our Cookie Settings or another consent mechanism we make available. You may change or withdraw your consent at any time through the "Cookie Settings" link in the footer of our Website.

We do not currently use website analytics cookies for targeted advertising, retargeting, custom audience advertising, or cross-context behavioural advertising.

You may also manage browser-based cookies through your browser settings. If you block or delete certain cookies, some website features may not work properly.

WEBSITE ADVERTISING

We do not currently use our websites to collect personal information for targeted advertising, retargeting, custom audience advertising, or cross-context behavioural advertising.

Advertising-related data collection described in this Policy applies only to the App and only where permitted by law, subject to Apple App Tracking Transparency, the App's Advertising setting, and applicable privacy rights.

EXTERNAL LINKS AND THIRD-PARTY INFORMATION COLLECTION

Some of the Kova AI Solutions may include third-party SDKs, APIs, analytics tools, advertising technologies, authentication tools, payment tools, crash-reporting tools, or similar technologies. Where these third parties process personal information on our behalf, we use contractual or other measures designed to require appropriate protection and limit processing to authorized purposes. Where a third party processes personal information as an independent business, controller, or third party for its own purposes, that processing may also be subject to the third party's own privacy policy.

Our Website and App may also contain links to third-party websites, platforms, or services that we do not control. If you follow a link to a third-party service, that service's privacy policy and terms will apply.

Our Website and our App may occasionally contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to one of these websites, please note that these websites are governed by their own privacy policies and that we are not responsible for these policies. Please check these policies before submitting any personal data to these websites.

In addition, the App may allow you to download, export or otherwise make content created using the App (including Audio Assets) available to third-party platforms such as YouTube, podcast platforms, social-media services, video or audio streaming services and similar distribution channels. If you choose to share or upload any content to such third-party services, including Audio Assets that contain personal information, that content will be handled in accordance with the privacy policies and terms of use of those third parties, not this Policy. We do not control how those third parties collect, use or disclose such information, and we encourage you to review their privacy policies before sharing any content with them.

HOW WE USE YOUR INFORMATION

We use the categories of information that we collect about you or that you provide to us for the following business and commercial purposes:

Service Delivery:

• to provide our Kova AI Solutions, and other related services, to conduct our business, for payment and billing processing, to administer and perform our services;
• to carry out our obligations arising from any agreements entered between you and us;
• to create your account, to manage it and to manage your orders or use of our Kova AI Solutions. An Apple or Google user account is used to verify and authenticate users;
• To operate features of the App that allow you to generate, access, download, store, and export Audio Assets you create using the App, and, where you choose to do so, to share or upload such Audio Assets to third-party platforms (for example, YouTube, podcast platforms, social-media services, and other distribution channels), in accordance with our General Terms and Conditions of Use;

Communication:

• to respond to requests for information or enquiries from visitors to our Website, our Kova AI Services platform or our App users;
• In the case of job applicants, to contact the applicant and assess whether we will hire them;
• To assess whether we will retain your services and to keep in touch with you if necessary;
• To facilitate the use of our Website, our Kova AI Services platform and our App and to ensure content from our Website and our App is presented in the most effective manner for you and your device. Information such as your birth year, subjects liked at school, interests, preferred format, preferred synthetic voice selections and recommended courses like/dislike are used to recommend content;

Marketing and Advertising: to provide details of new services or products, updates, or newsletters when an individual has chosen to receive these. You may require that we stop doing any of the foregoing at any time.

Legal & Compliance: to fulfill our legal, regulatory, or risk management obligations, and to comply with our legal obligations.

DISCLOSURE OF PERSONAL INFORMATION

We may disclose, transfer, make available, or otherwise communicate personal information to the categories of recipients described below, only as reasonably necessary for the purposes described in this Privacy Policy, as otherwise disclosed to you at or before the time of collection, with your consent, or as permitted or required by applicable law.

For clarity, "disclose" or "communicate" includes making personal information available to service providers, contractors, business partners, advertising and analytics partners, professional advisors, authorities, or other third parties, whether located in Canada, the United States, or another jurisdiction.

1. Service providers and contractors

We may disclose personal information to vendors, service providers, contractors, processors, and other third parties that perform services for us or on our behalf. These services may include cloud hosting, data storage, content delivery, authentication, payment processing, customer support, analytics, security, fraud prevention, infrastructure monitoring, AI content generation, text-to-speech processing, email delivery, and other technical or business operations.

These service providers may process categories of personal information such as account information, contact information, device and usage information, payment and billing information, text inputs, prompts, scripts, generated content, synthetic audio outputs, Audio Assets, support communications, API usage data, and other information reasonably necessary to provide their services. For clarity, we do not provide service providers with user voice recordings, voice samples, voiceprints, voice embeddings, biometric identifiers, or biometric templates because we do not collect that information.

We require service providers to use personal information only for the purposes for which we disclose it to them or as otherwise permitted by applicable law, and to protect personal information using appropriate contractual, technical, and organizational safeguards.

2. AI, text-to-speech, and content-generation providers

To operate Kova's AI, text-to-speech, audiobook, and content-generation features, we may disclose text inputs, prompts, scripts, generated text, synthetic audio outputs, Audio Assets, metadata, and related technical information to AI, text-to-speech, audio-generation, or content-generation providers.

These providers process such information only to provide the requested service to us or to you, unless we have disclosed another purpose and obtained any consent required by applicable law. For clarity, Kova does not collect or disclose user voice recordings, voice samples, voiceprints, voice embeddings, biometric identifiers, or biometric templates to these providers. We use contractual or technical measures designed to prohibit providers from using your personal information or user content to train their general models, except where we have expressly disclosed that use and obtained any consent required by applicable law. As stated above, Kova does not use user uploads, prompts, scripts, Audio Assets, or generated content to train, fine-tune, evaluate, improve, or benchmark Kova's models or third-party models.

Where you upload, generate, or include personal information about yourself or others in prompts, scripts, files, or Audio Assets, that information may be processed as part of providing the requested Kova AI Solutions however we do not use any of the personal information or generated content to train, fine-tune, evaluate, improve, or benchmark Kova's models or third-party models.

3. Payment processors and app platforms

We may disclose personal information to payment processors, app stores, subscription-management providers, and billing platforms to process payments, manage subscriptions, prevent fraud, issue refunds, maintain transaction records, and comply with tax, accounting, and legal obligations.

For example, if you purchase a subscription through the Apple App Store or another third-party platform, your purchase may also be subject to that platform's own privacy policy and terms.

4. Authentication and account providers

If you sign in using Apple, Google, or another third-party authentication provider, we may receive and disclose information necessary to authenticate you, create or manage your account, link your third-party account to your Kova profile, and maintain account security.

5. Analytics providers

We may disclose device information, identifiers, usage events, product interactions, approximate location information, and similar technical or usage information to analytics providers to understand how users interact with our Website, App, Kova AI Services, and other Kova AI Solutions; measure performance; improve features; debug issues; prevent abuse; and develop new products.

Website analytics are controlled through Cookie Settings and are disabled by default unless you provide consent.

App analytics are controlled through the App's Analytics setting and are disabled by default unless you enable that setting.

We do not use analytics information for targeted advertising unless separately disclosed and authorized through the App's Advertising setting and any consent required by applicable law.

6. Advertising and marketing partners

Advertising-related data collection applies only to the App. By default, the App is configured not to track your device and not to collect personal information for advertising purposes.

If you grant Apple App Tracking Transparency permission and enable the App's Advertising setting, we may disclose App personal information to advertising, attribution, and marketing partners to measure advertising performance, understand whether our ads are effective, attribute installs or conversions, limit ad frequency, prevent advertising fraud, conduct campaign-performance analysis, and deliver targeted advertising.

This may include IDFA, device information, App events, advertising interaction information, attribution data, campaign information, and similar pseudonymous identifiers. We do not use our websites to collect personal information for targeted advertising, retargeting, custom audience advertising, or cross-context behavioural advertising.

7. Public or user-directed sharing

Certain Kova features may allow you to publish, export, download, share, or otherwise make available content that you create, including Audio Assets, scripts, text, images, synthetic audio files, audiobooks, metadata, profile information, comments, or other user-generated content.

When you choose to make content public or share it with another person, platform, or third-party service, you direct us to disclose that content and any personal information contained in it. Once disclosed to a third party or made public, that information may be collected, used, disclosed, indexed, downloaded, copied, or stored by others, and may be governed by the privacy policies and terms of those third parties rather than this Privacy Policy.

8. Affiliates and corporate group

We may disclose personal information to our affiliates, subsidiaries, parent companies, or related entities for purposes consistent with this Privacy Policy, including providing and improving the Kova AI Solutions, operating our business, security, legal compliance, internal administration, and customer support.

9. Professional advisors

We may disclose personal information to lawyers, auditors, insurers, accountants, bankers, consultants, and other professional advisors where reasonably necessary for business, financial, insurance, accounting, legal, compliance, or risk-management purposes.

10. Business transactions

We may disclose or transfer personal information in connection with a proposed or completed business transaction, including a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, due diligence process, investment, or transfer of all or part of our business.

Where required by applicable law, we will use contractual or other measures designed to protect personal information during the transaction and to ensure that the recipient uses the information only for authorized purposes.

11. Legal, security, and safety reasons

We may disclose personal information where we believe in good faith that disclosure is necessary or permitted under applicable law, including to:

• comply with legal obligations, court orders, subpoenas, warrants, regulatory requests, or lawful government demands;
• enforce our terms, policies, agreements, or legal rights;
• detect, investigate, prevent, or respond to fraud, abuse, security incidents, illegal activity, or technical issues;
• protect the rights, property, safety, or security of Kova, our users, employees, contractors, business partners, or the public;
• establish, exercise, or defend legal claims.

12. With your consent or at your direction

We may disclose personal information with your consent or at your direction, including when you authorize an integration, connect a third-party account, ask us to share information with another service, invite another user, collaborate with another person, or otherwise choose to disclose information through the Kova AI Solutions.

13. De-identified, aggregated, or anonymized information

Where permitted by applicable law, we may anonymize personal information so that it irreversibly no longer allows you to be identified directly or indirectly, using generally accepted best practices and any legally required criteria. We may use anonymized information for serious and legitimate purposes, including analytics, research, security, service improvement, and product development.

We may also create or use de-identified or aggregated information where permitted by applicable law. We will not attempt to re-identify information that has been anonymized or de-identified, except as permitted or required by law, such as to test the effectiveness of our de-identification safeguards.

14. Cross-border disclosures

We may disclose personal information to recipients located outside your province, state, or country of residence, including in Canada, the United States, and other jurisdictions where our service providers or partners operate.

When personal information is transferred or made available outside Quebec or Canada, it may be subject to the laws of the receiving jurisdiction and may be accessible to courts, law-enforcement authorities, national-security authorities, or regulators in that jurisdiction.

U.S. STATE PRIVACY DISCLOSURE NOTE

For residents of U.S. states with applicable privacy laws, the categories of personal information we disclose may include:

• identifiers, such as name, email address, account ID, IP address, device identifiers, and advertising identifiers;
• commercial information, such as subscriptions, purchases, billing records, and usage history;
• internet or electronic network activity information, such as App usage, Website activity, analytics events, and, where App advertising is enabled, interaction with App ads;
• location: approximate geolocation information derived from IP address or device information;
• user-shared content: audio, electronic, visual, or similar information, including generated synthetic audio content;
• user-generated content, including prompts, scripts, uploaded text files or documents, Audio Assets, and other content you create or provide;
• inferences, such as preferences, interests, recommended content, and product usage patterns.

We do not intentionally collect sensitive personal information. We do not collect voice recordings, voice samples, voiceprints, voice embeddings, biometric identifiers, biometric templates, precise geolocation, health information, genetic information, government identification numbers, or similar sensitive personal information. Payment information is processed by our payment processors or app platform providers, such as Stripe, Apple, or other applicable platforms. Kova does not store full payment card numbers or card security codes. Where we use authentication tokens, OAuth identifiers, API keys, or similar security credentials, we treat them as confidential security information and protect them with appropriate safeguards. We do not use such information for advertising.

We may disclose these categories of personal information for the business and commercial purposes described in this Privacy Policy, including service delivery, authentication, payment processing, analytics, security, legal compliance, customer support, product improvement, user-directed sharing, and App advertising where Apple App Tracking Transparency permission has been granted and the App's Advertising setting has been enabled.

We may disclose personal information to the following categories of recipients:

• cloud hosting, infrastructure, and storage providers;
• AI, synthetic audio, text-to-speech, and content-generation providers;
• payment processors and app stores;
• authentication providers;
• analytics providers;
• advertising, attribution, and marketing partners;
• customer support and communication providers;
• security, fraud-prevention, and monitoring providers;
• professional advisors;
• affiliates and related companies;
• government, regulatory, legal, or law-enforcement authorities where required or permitted by law;
• third parties involved in business transactions;
• other users, platforms, or services at your direction.

Where our use of App advertising technologies, including IDFA, App events, advertising SDKs, or similar App technologies, is considered a "sale," "sharing," or "targeted advertising" under applicable U.S. privacy laws, you may have the right to opt out.

U.S. STATE PRIVACY RIGHTS

Depending on where you live and subject to applicable legal limitations, you may have some or all of the following rights regarding your personal information:

• the right to know or confirm whether we process your personal information;
• the right to access the personal information we process about you;
• the right to correct inaccurate personal information;
• the right to delete personal information provided by or obtained about you;
• the right to obtain a copy of personal information you previously provided to us in a portable and, where technically feasible, readily usable format;
• the right to opt out of the sale of personal information;
• the right to opt out of sharing personal information for cross-context behavioural advertising;
• the right to opt out of targeted advertising;
• the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable;
• because we do not intentionally collect sensitive personal information, we generally do not use or disclose sensitive personal information for purposes that would require a right to limit. If this changes, we will update this Privacy Policy and provide any notices, consents, or rights required by applicable law;
• the right not to be discriminated against or retaliated against for exercising privacy rights.

You may exercise your privacy rights by emailing us at privacy@evalabs.ai or using privacy controls available in your account or App settings where available. We also honor requests to opt-out submitted via privacy preference signals, such as the Global Privacy Control (GPC). (For more information on the GPC and how to use a browser or browser extension incorporating the GPC signal, please follow the instructions at https://globalprivacycontrol.org/)

We may need to verify your identity before responding to certain requests. We will use information provided for verification only to verify and respond to your request, unless otherwise permitted by law. You do not need to create a new account to exercise your privacy rights, but we may ask you to use an existing account where appropriate.

We will respond to privacy rights requests within the time required by applicable law. For many U.S. state privacy laws, this period is 45 days, subject to an extension where permitted by law.

If we deny your request, you may have the right to appeal our decision. We will explain how to appeal in our response. If your appeal is denied, we will provide information about how you may contact the relevant regulator where required by law.

You may also authorize another person or business to submit a privacy request on your behalf where permitted by law. We may require proof that the authorized agent has authority to act for you.

THIRD-PARTY SERVICE PROVIDERS AND PARTNERS

The Company employs third-party service providers to store, handle or process personal information on our behalf (such as to store and process data, cloud computing, payment processing). We use contractual and other means to provide a comparable level of protection while the information is being stored, handled or processed by those service providers.

Our service providers are committed by contractual agreements with us to protect your personal information from unauthorized access, collection, use or communication. We limit the personal information we disclose to them to what is reasonably necessary for the performance of their duties and only for the purposes for which we are authorized. Depending on how you use the Kova AI Solutions, we may use the following third-party service providers to store, handle, or process personal information on our behalf or for the purposes described below.

Some third parties listed below act as service providers or processors that process personal information on our behalf. Others, including certain advertising, attribution, analytics, payment, app platform, or authentication partners, may process personal information as independent businesses, controllers, or third parties for some purposes, as described in their own privacy policies and our agreements with them.

TARGETED ADVERTISING, APPLE IDFA, AND YOUR PRIVACY CHOICES

Advertising-related data collection applies only to the App.

By default, the App is configured not to track your device and not to collect personal information for advertising purposes. We will not access Apple's Identifier for Advertisers, or IDFA, and we will not collect, use, or disclose App data for targeted advertising unless you grant permission through Apple's App Tracking Transparency prompt and enable advertising through the App's Advertising setting.

For users of our iOS App, advertising-related data collection may include Apple's Identifier for Advertisers, or IDFA, where authorized. IDFA is a device-level advertising identifier made available by Apple. Although IDFA does not directly reveal your name or email address, it can be used to recognize a device for advertising, attribution, measurement, retargeting, and related purposes. We therefore treat IDFA and related advertising information as personal information or personal data where required by applicable law.

If you grant Apple App Tracking Transparency permission and enable the App's Advertising setting, we may use or disclose IDFA, device information, App events, advertising interaction information, attribution data, and similar pseudonymous identifiers to advertising and attribution partners, including Meta where applicable, for advertising measurement, attribution, frequency capping, fraud prevention, campaign-performance analysis, and targeted advertising, subject to your privacy choices and applicable law.

If Apple App Tracking Transparency permission is denied, or if the App's Advertising setting is disabled, we will not access IDFA for advertising tracking and will not collect, use, or disclose App data for targeted advertising.

We do not currently offer separate customized advertising categories or granular advertising options. The App's Advertising setting is a single control for advertising-related data collection and disclosure.

Where required by law, we will obtain your consent before using IDFA or similar identifiers for tracking or targeted advertising. In Canada, meaningful consent is required for the collection, use, and disclosure of personal information, including in the context of online behavioural advertising.

Apple App Tracking Transparency

For users of our iOS App, we may request permission through Apple's App Tracking Transparency framework to access Apple's Identifier for Advertisers, or IDFA, and to use app activity information for advertising measurement, attribution, targeted advertising, retargeting, frequency capping, fraud prevention, and campaign-performance analysis.

IDFA is a device-level advertising identifier. Although it does not directly reveal your name or email address, we treat IDFA and related advertising information as personal information or personal data where required by applicable law.

We will not access IDFA or use it for targeted advertising unless you grant permission through Apple's App Tracking Transparency prompt. If you select "Ask App Not to Track," we will not access IDFA for tracking or targeted advertising, and we will not attempt to work around your choice by using fingerprinting or similar tracking methods.

If you grant Apple App Tracking Transparency permission and enable the App's Advertising setting, we may disclose IDFA, device information, App events, advertising interaction information, attribution data, and similar pseudonymous identifiers to advertising and attribution partners, including Meta where applicable, for the advertising purposes described in this Privacy Policy and subject to your privacy choices. If either Apple App Tracking Transparency permission is denied or the App's Advertising setting is disabled, we will not access IDFA for advertising tracking and will not collect, use, or disclose App data for targeted advertising. You may change your App Tracking Transparency choice at any time by going to Settings → Privacy & Security → Tracking on your iPhone or iPad.

OPT-OUT OF SALE, SHARING, AND TARGETED ADVERTISING

Depending on where you live, you may have the right to opt out of the sale of your personal information, the sharing of your personal information for cross-context behavioural advertising, or the processing of your personal information for targeted advertising.

We do not knowingly sell personal information for money. However, some U.S. state privacy laws define "sale," "sharing," or "targeted advertising" broadly. As a result, our use or disclosure of IDFA, device information, App events, advertising identifiers, or similar App information for targeted advertising, advertising measurement, attribution, retargeting, or campaign-performance analysis may be considered a "sale," "sharing," or processing for "targeted advertising" under certain U.S. privacy laws.

You may opt out of Kova's use or disclosure of App personal information for sale, sharing, or targeted advertising by disabling the App's Advertising setting: Settings → Privacy → Advertising.

If the App's Advertising setting is disabled, we will not sell or share your personal information or process App information for targeted advertising, unless you later enable that setting and grant any consent required by applicable law.

For iOS users, you can also control whether the App may track you through Apple's iOS tracking settings: Settings → Privacy & Security → Tracking. From there, you can turn tracking permission on or off for the App. If you select "Ask App Not to Track," we will not access IDFA for advertising tracking or use IDFA for targeted advertising.

We will process opt-out requests as soon as reasonably feasible and within the time required by applicable law. Where California law applies, we will process sale/share opt-out requests no later than 15 business days after receipt. Where California law applies, after you opt out of the sale or sharing of personal information, we will not ask you to authorize the sale or sharing of your personal information again for at least 12 months, except as permitted by applicable law.

Your opt-out will not prevent all advertising. You may still see contextual ads, service messages, transactional notices, account-related communications, or ads that do not rely on IDFA, targeted advertising, or cross-context behavioural advertising.

We will not discriminate against you for exercising your privacy rights.

1. App Privacy Settings

The Analytics setting and the Advertising setting are separate. Enabling App Analytics does not enable App Advertising, targeted advertising, IDFA-based tracking, sale, sharing, retargeting, custom audience advertising, or disclosure of App data to advertising partners. The App's Advertising setting controls advertising-related data collection and disclosure.

We do not currently offer separate customized advertising categories or granular advertising options. The App's Advertising setting is a single control for advertising-related data collection and disclosure.

The App includes two separate privacy settings, and both are disabled by default:

• Settings → Privacy → Analytics
• Settings → Privacy → Advertising

Analytics setting. The Analytics setting controls whether Kova may collect and use App analytics information to understand how users interact with the App, measure performance, improve features, debug issues, understand retention, and improve the App. If the Analytics setting is disabled, we do not collect App analytics data, except for information that is strictly necessary to provide the App, maintain security, prevent fraud or abuse, comply with law, or honor your privacy choices.

Advertising setting. The Advertising setting controls whether Kova may collect, use, or disclose App information for advertising-related purposes, including targeted advertising, advertising measurement, attribution, frequency capping, fraud prevention, campaign-performance analysis, and related advertising operations. If the Advertising setting is disabled, we do not collect, use, or disclose App data for targeted advertising.

The Advertising setting does not override Apple App Tracking Transparency. For iOS users, we will not access IDFA or track your device for advertising unless you grant permission through Apple App Tracking Transparency and enable the App's Advertising setting.

You may change either setting at any time in the App by going to Settings → Privacy.

2. Apple iOS tracking controls

You can also control whether the App may track you through Apple's iOS tracking settings. On iPhone or iPad, go to: Settings → Privacy & Security → Tracking.

From there, you can turn off tracking permission for the App. You may also turn off Allow Apps to Request to Track, which prevents apps from asking for tracking permission. Apple states that when this setting is turned off, apps that ask for permission to track are treated as if the user selected "Ask App Not to Track."

3. Global Privacy Control

Where required by applicable law, we will honor Global Privacy Control and other legally recognized browser-based opt-out preference signals as a request to opt out of the sale or sharing of personal information and, where applicable, targeted advertising, for the browser sending the signal.

Because Global Privacy Control is a browser-based signal, it applies to our websites and browser-based services. It does not control privacy settings inside the App. App users should use the App's Privacy settings and Apple iOS tracking controls described above.

Because we do not currently use our websites to collect personal information for targeted advertising, retargeting, custom audience advertising, or cross-context behavioural advertising, honoring a browser-based opt-out preference signal for the Website may not change any active website advertising setting. App users should use the App's Privacy settings and Apple iOS tracking controls to manage App analytics and App advertising.

4. Effect of opting out

If you opt-out, we will stop using and disclosing personal information for targeted advertising, retargeting, cross-context behavioural advertising, and advertising audience creation.

Your opt-out will not prevent all advertising. You may still see:

• contextual ads;
• ads based on the content or feature you are using;
• ads that do not rely on IDFA or cross-context behavioural advertising;
• service messages, transactional notices, or account-related communications.

We may also continue to use personal information for non-advertising purposes, including providing the Kova AI Solutions, account authentication, payment processing, security, fraud prevention, debugging, analytics that are not used for targeted advertising, legal compliance, and responding to your requests.

5. No discrimination

We will not discriminate against you for exercising your privacy rights. This means we will not deny you services, charge you a different price, provide a different level or quality of service, or retaliate against you because you opted out, except where permitted by applicable law.

6. Contact us

If you have questions about your privacy choices or would like help exercising your opt-out rights, you may contact us at: Privacy Officer, EXPRESSIVE VOICE ASSISTANT LABORATORIES, INC., privacy@evalabs.ai

COMMUNICATION OUTSIDE OF QUEBEC OR CANADA

When personal information is located outside of Canada, it may be accessible by foreign governments, courts and other governmental authorities, if required by law or court order. We will only communicate or transfer personal information outside Canada in compliance with applicable Canadian laws and for lawful purposes.

When we communicate personal information outside Quebec, and sometimes outside Canada, we do so only for the purpose of providing the services, including our Website and our App, or to support our business so that we can offer our services reasonably efficiently and at commercially reasonable costs.

Before communicating personal information outside Quebec, we conduct a privacy impact assessment in accordance with applicable Quebec law. This assessment takes into account: (i) the sensitivity of the information; (ii) the purpose for which it is to be used; (iii) the safeguards, including contractual safeguards, from which the information would benefit; and (iv) the legal regime applicable in the jurisdiction to which the information would be communicated, including generally accepted privacy principles applicable therein. Personal information is only communicated if the assessment demonstrates that it would benefit from adequate protection. If you would like more information about the service providers that we use and to whom personal information is communicated outside Quebec, please contact our Privacy Officer (identified below). We confirm that we may, strictly in accordance with this Policy, communicate your personal information outside Quebec or Canada to third parties we retain to provide us with services involving the use, communication or retention of your personal information on our behalf. Where required by applicable law, we will obtain your consent before communicating, using, or retaining personal information outside Quebec or Canada. Where a cross-border transfer is necessary to provide the Kova AI Solutions or support our business operations, we will handle that transfer in accordance with applicable law, this Privacy Policy, our contractual safeguards, and our privacy impact assessment process. Where required by Quebec law, any communication of personal information outside Quebec, or any entrustment of personal information to a person or body outside Quebec to collect, use, communicate, keep, or otherwise process such information on our behalf, will be governed by a written agreement that takes into account the results of the privacy impact assessment and any measures required to mitigate identified risks.

When you choose to share or upload Audio Assets or other content from the App to third-party platforms, you understand that any personal information contained in such content may become accessible outside Quebec or Canada and will be governed by the privacy policies of those third parties.

REGIONAL PRIVACY RIGHTS

The Company is established in Quebec, Canada, and we process personal information in accordance with applicable privacy laws. Depending on where you live, you may have additional privacy rights under federal, provincial, state, or local law. Nothing in this Privacy Policy is intended to limit any mandatory privacy rights that cannot be limited by contract.

If a region-specific privacy notice applies to you, that notice supplements this Privacy Policy. If there is a conflict between this Privacy Policy and a region-specific notice, the region-specific notice will apply to the extent of the conflict.

PERSONAL INFORMATION GOVERNANCE POLICIES AND PRACTICES AND INFORMATION SECURITY

Our Commitment to Your Privacy: we take the security and responsible management of your personal information very seriously. Our privacy governance policies have been formally approved by our Privacy Officer. These policies and practices are designed to match the scope and complexity of our various business activities. The following subsections provide detailed information, in simple and clear terms, to inform you about our personal information governance policies and practices.

Data Lifecycle Management: our policies cover the entire life cycle of your personal information. We retain your personal information only as long as necessary to fulfill the purposes for which it was originally collected, except as otherwise permitted or required by applicable law or regulation, such as tax laws. Once personal information has served its purpose, we ensure its secure and responsible destruction or anonymization, following strict guidelines.

Responsibilities of Employees and Service Providers: within our organizational structure, roles and responsibilities regarding the handling and management of personal information are clearly defined for our employees. All employees undergo regular training and are held accountable for compliance with our privacy standards. As far as service providers are concerned, we establish contractual relationships exclusively with entities that undertake to respect industry-standard security measures and comply with the law. These agreements have been carefully reviewed to ensure that they comply with applicable laws and the principles set out in this Policy.

Security and Compliance Assessments: to ensure ongoing compliance with our policies and practices, we conduct periodic internal assessments. These assessments examine how personal information is collected, stored, processed, and disposed of, and involve a thorough review of our processes and procedures. The assessments help us to determine the effectiveness of our existing security measures and to propose ongoing improvements.

Complaints Handling: in keeping with our commitment to the protection of personal information, we have established a formal process for receiving, investigating, and resolving any complaints about the safeguarding of your personal information.

Security Measures: to protect your personal information, we use a multi-layered security approach that includes physical, electronic, and administrative measures to prevent unauthorized access, use, alteration, or disclosure of your personal information.

While these policies and measures are aligned with generally recommended practices, it is important to recognize that the absolute security of your personal information when transmitted online or when using online services or our App cannot be unconditionally guaranteed. Such transmissions are therefore at your own risk.

We strive to present this Policy in a simple and easily understandable manner, to ensure that you are fully informed of how we treat your personal information.

Privacy Incidents and Breach Notification: if we become aware of a privacy incident, confidentiality incident, or breach of security safeguards involving personal information, we will take reasonable steps to contain the incident, reduce the risk of harm, investigate the cause, and prevent similar incidents from recurring. Where required by applicable law, we will notify affected individuals, privacy regulators, law-enforcement authorities, service providers, business partners, or other relevant parties. In Canada, this may include reporting to the Office of the Privacy Commissioner of Canada and notifying affected individuals where a breach of security safeguards creates a real risk of significant harm. In Quebec, this may include notifying the Commission d'accès à l'information and affected individuals where a confidentiality incident presents a risk of serious injury.

We maintain records of privacy incidents and breaches where required by applicable law.

Governance: we conduct privacy assessments, data protection assessments, or privacy impact assessments where required by applicable law or where appropriate based on the sensitivity of the information, the nature of the processing, and the potential risks to individuals. This may include assessments for targeted advertising, processing of sensitive information if applicable, use of AI systems, cross-border transfers, new product features, and material changes to systems that collect, use, disclose, retain, or destroy personal information.

DATA RETENTION

Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Where permitted by applicable law, we may anonymize personal information so that it irreversibly no longer allows you to be identified directly or indirectly, using generally accepted best practices and any legally required criteria. We may use anonymized information for serious and legitimate purposes, including analytics, research, security, service improvement, and product development.

We may also create or use de-identified or aggregated information where permitted by applicable law. We will not attempt to re-identify information that has been anonymized or de-identified, except as permitted or required by law, such as to test the effectiveness of our de-identification safeguards.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Our retention periods vary depending on the type of information, the purpose for which it is used, legal requirements, and operational needs.

By way of example:

• Account information is generally retained while your account is active and for a reasonable period after account closure to support account recovery, legal compliance, fraud prevention, dispute resolution, and backup restoration.
• User Content and Audio Assets are generally retained while your account is active or until you delete them, unless a longer period is required for legal, security, backup, dispute-resolution, or contractual reasons.
• Billing and transaction records may be retained for the period required for accounting, tax, audit, and legal compliance.
• Advertising identifiers, IDFA, attribution data, and advertising events are retained only for as long as reasonably necessary for advertising measurement, attribution, fraud prevention, legal compliance, and opt-out management, subject to your privacy choices.
• Security logs, diagnostic logs, and fraud-prevention records may be retained for a reasonable period to protect the Kova AI Solutions, investigate abuse, and maintain security.
• Support communications may be retained for a reasonable period to respond to your requests, improve support, and maintain business records.
• Job applicant and employee information is retained in accordance with employment, tax, legal, and business-record requirements.

When personal information is no longer required, we will securely delete it, anonymize it, or de-identify it in accordance with applicable law and our retention procedures.

PRIVACY OFFICER/YOUR RIGHTS

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes. By law you have the right to request access to and to correct the personal information that we hold about you.

If you want to review, verify, correct, or withdraw consent to the use of your personal information you may send us an email at the email address of the Privacy Officer to request access to, correct, or delete any personal information that you have provided to us.

Additional Quebec Rights

If you reside in Quebec, you may have additional rights under Quebec privacy law, subject to applicable exceptions. These may include the right to receive computerized personal information collected from you, and not created or inferred by us, in a structured, commonly used technological format, unless doing so raises serious practical difficulties. You may also have certain rights to request that we cease disseminating personal information or de-index or re-index a hyperlink associated with your name where the legal conditions are met. We will also respond to access or rectification requests promptly and no later than 30 days after receipt, subject to applicable legal exceptions. If we refuse a request, we will provide reasons where required by law and indicate the remedies available to you.

Privacy Officer. Attention: Privacy Officer, privacy@evalabs.ai

We may not accommodate a request if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

CHANGES TO OUR PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make changes, we will update the "Last modified" date at the top of this Policy.

If we make material changes to this Privacy Policy, we will provide notice as required by applicable law, which may include notice by email, in-App notice, Website notice, account notice, or another appropriate method.

If a change requires your consent under applicable law, we will seek that consent before applying the change to you. Your continued use of the Kova AI Solutions after an updated Privacy Policy becomes effective means that the updated Policy applies to your use of the Kova AI Solutions from that point forward, subject to any consent rights or other rights you may have under applicable law.

COMPLAINTS

The Company will respond to complaints from individuals or questions about our compliance with this Policy and with applicable privacy laws. We will investigate and attempt to resolve all complaints. To challenge our compliance with this Policy please contact our Privacy Officer at the co-ordinates listed above. Alternatively, you also have the right to file a complaint with the privacy regulator in your jurisdiction, such as the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or an applicable U.S. state privacy regulator.