Privacy Policy

Last updated August 21, 2026

This Privacy Notice for Rideau Lakes LLC, doing business as Four-Leaf ("we," "us," or "our"), describes how and why we might access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.four-leaf.ai or any website of ours that links to this Privacy Notice
• Use Four-Leaf, our AI-powered job search assistant. Four-Leaf provides resume tailoring, cover letter generation, mock interview practice, interview prep, comp negotiation coaching, an in-product AI assistant (Clover), email writing, LinkedIn profile optimization, AI job search, and application tracking.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, contact us at team@four-leaf.ai.

Summary of key points

This summary covers the highlights. Use the table of contents below to jump to a specific section.

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
• Do we process any sensitive personal information? We do not process information considered "special" or "sensitive" in your jurisdiction (such as racial or ethnic origin, sexual orientation, or religious beliefs).
• Do we collect any information from third parties? Only from services you choose to connect. If you sign in with Google or LinkedIn we receive your basic profile from them, and Stripe tells us when a subscription payment succeeds. We do not buy personal information or receive it from data brokers.
• How do we process your information? To provide, improve, and administer our Services, to communicate with you, for security and fraud prevention, and to comply with the law.
• In what situations and with which parties do we share personal information? Only with the third-party service providers listed in Section 4, and only as needed to deliver the Services.
• How do we keep your information safe? Reasonable organizational and technical safeguards. No system is perfect, and we cannot guarantee absolute security.
• What are your rights? Depending on where you live, you may have access, correction, deletion, portability, and opt-out rights under your local privacy laws.
• How do you exercise your rights? Email team@four-leaf.ai. We will consider and act on every request in accordance with applicable law.

Table of contents

1. What information do we collect?
2. How do we process your information?
3. What legal bases do we rely on?
4. When and with whom do we share your personal information?
5. Do we use cookies and other tracking technologies?
6. Do we offer artificial-intelligence-based products?
7. How do we handle your social logins?
8. Is your information transferred internationally?
9. How long do we keep your information?
10. How do we keep your information safe?
11. Do we collect information from minors?
12. What are your privacy rights?
13. Universal opt-out signals and Do-Not-Track
14. Do United States residents have specific privacy rights?
15. Do we make updates to this notice?
16. How can you contact us about this notice?
17. How can you review, update, or delete the data we collect from you?

1. What information do we collect?

Personal information you disclose to us

In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register for the Services, express an interest in obtaining information about us or our products, participate in activities on the Services, or otherwise contact us.

Personal information provided by you. The personal information we collect depends on the context of your interactions with us, the choices you make, and the features you use. It may include:

• Name
• Email address
• Job title and target role
• Job descriptions you save
• Resume content (uploaded or pasted)
• Cover letter drafts
• Voice recordings of mock interview sessions
• Interview transcripts and your responses
• Chat messages you send to Four-Leaf's AI assistants (Clover, email assistant, comp negotiation coach, LinkedIn optimizer)
• Mailing address (if provided)
• Phone number (if provided)
• Username and authentication credentials

Sensitive information. We do not process sensitive information.

Payment data. We collect the data necessary to process your payment if you make a purchase, including your payment instrument number and the associated security code. All payment data is handled and stored by Stripe. See their privacy notice at https://stripe.com/privacy.

Social media login data. If you choose to register with us using a social media account (for example, Google), we receive certain profile information from that provider, as described in Section 7.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In short: some information, such as your IP address and browser characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not directly reveal your identity but may include device and usage information such as IP address, browser and device characteristics, operating system, language preferences, referring URLs, country, location, and other technical information. We use this to maintain the security and operation of our Services and for internal analytics and reporting.

We also collect information through cookies and similar technologies. See our Cookie Notice for details.

The information we collect includes:

• Log and usage data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services. Depending on how you interact with us, this may include your IP address, device information, browser type, and information about your activity (timestamps, pages viewed, features used, searches, and other actions), plus device-event information such as crash reports and hardware settings.

2. How do we process your information?

In short: we process your information to provide, improve, and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason.

We process your personal information for the following purposes:

• To facilitate account creation, authentication, and account management. So you can create and log in to your account and keep it in working order.
• To deliver the Services. To provide the features you sign up for, including resume tailoring, cover letter generation, mock interviews, interview prep, comp coaching, the in-product Clover assistant, email drafting, LinkedIn optimization, AI job search, and application tracking.
• To request feedback. To contact you about your use of our Services and gather product feedback.
• To send marketing and promotional communications. Only in line with your marketing preferences. You can opt out at any time (see Section 12).
• To protect our Services. Fraud monitoring, abuse prevention, and security maintenance.
• To identify usage trends. To understand how the Services are used so we can improve them.
• To save or protect a vital interest. When necessary to prevent harm.
• AI-powered content processing. User-submitted content (resumes, job descriptions, voice recordings, interview responses, and chat messages) is processed through third-party AI services to generate personalized career preparation materials. See Section 6 for the AI-specific details.

3. What legal bases do we rely on?

In short: we only process your personal information when we have a valid legal reason (consent, contract performance, legal obligation, or legitimate interest) under applicable law.

If you are located in the EU or UK, this section applies to you.

Under the GDPR and UK GDPR, we may rely on the following legal bases:

• Consent. When you have given us permission to process your personal information for a specific purpose. You can withdraw consent at any time.
• Performance of a contract. When processing is necessary to fulfill our contract with you, including providing the Services.
• Legitimate interests. When processing is reasonably necessary for our legitimate business interests and those interests do not override your rights. Examples include sending you product updates, analyzing usage to improve the Services, diagnosing problems, preventing fraud, and delivering the core AI-powered features you have subscribed to.
• Legal obligations. When processing is necessary for compliance with law, including responses to law enforcement.
• Vital interests. When processing is necessary to protect a person's life or safety.

If you are located in Canada, this section applies to you.

We may process your information if you have given express or implied consent. You can withdraw your consent at any time. In limited circumstances permitted by applicable law, we may process information without consent, including when:

• Collection is clearly in your interests and consent cannot be obtained in time
• It is needed for fraud detection and prevention
• It is needed for certain business transactions
• It is contained in a witness statement related to an insurance claim
• It is needed to identify injured, ill, or deceased persons
• We have reasonable grounds to believe an individual is a victim of financial abuse
• Disclosure is required by subpoena, warrant, or court order
• The information was produced in the course of employment, business, or profession
• Collection is solely for journalistic, artistic, or literary purposes
• The information is publicly available and specified by regulation

4. When and with whom do we share your personal information?

In short: we may share information in specific situations described in this section and with the third parties listed below.

Service providers. We share data with third-party vendors and service providers who perform services for us and who need access to do that work. We have contracts in place with these third parties that require them to safeguard your personal information, restrict their use of it to the services we have instructed, and retain it only for the period we direct.

The third-party service providers we use are:

• AI service providers: Anthropic (Claude API) powers our generative AI features, including resume tailoring, cover letters, mock interview responses, the Clover in-product assistant, comp negotiation chat, email drafting, and LinkedIn profile optimization.
• Speech-to-text and text-to-speech: Deepgram transcribes interview audio and generates synthesized interviewer voice.
• Authentication and database: Supabase hosts user accounts and stores application data.
• Cloud hosting: Vercel hosts the application.
• Payments: Stripe processes subscription payments.
• Social login: Google, when you choose to register with a Google account.
• Analytics: PostHog and Google Analytics process usage analytics; Sentry processes error reports. PostHog also records session replays, in which text you type into the app is masked before it leaves your browser.
• Email delivery: Resend sends our transactional and lifecycle email and therefore receives your email address. Svix verifies the delivery webhooks Resend sends back to us.
• Internal alerting: Slack receives operational notifications about account activity, including the email address of a new signup, so a very small team can see what is happening in the product.
• Job search: SerpAPI receives the job title and location you search for when you use job discovery. It does not receive your name, resume, or account identifiers.
• Social login: LinkedIn, when you choose to register with a LinkedIn account.

We may also share your personal information in these situations:

• Business transfers. In connection with a merger, sale of company assets, financing, or acquisition.
• Legal obligations. When required by law, court order, or government request, or to protect our rights, your safety, or the safety of others.

5. Do we use cookies and other tracking technologies?

In short: yes, we use cookies and similar technologies to collect and store certain information.

We may use cookies and similar tracking technologies (such as web beacons and pixels) when you interact with our Services. Some help maintain security, prevent crashes, fix bugs, save your preferences, and support basic site functions.

We allow third parties and service providers to use online tracking technologies on our Services for analytics. We may use email marketing and re-engagement campaigns to communicate with you (subject to your preferences). We do not engage in display advertising, behavioral targeting, or retargeting through third-party advertising pixels.

To the extent these technologies are deemed a "sale" or "sharing" (including targeted advertising) under applicable US state laws, you can opt out by following the instructions in Section 14.

More details are available in our Cookie Notice.

6. Do we offer artificial-intelligence-based products?

In short: yes, most of our Services are powered by artificial intelligence. This section explains what that means for your data and how we keep our AI features safe.

Four-Leaf is a job search assistant. Almost every feature we offer is powered by large language models, machine learning, or similar technologies (collectively, "AI Products").

You are interacting with AI, not a human

When you use Clover, the email assistant, the comp negotiation coach, the LinkedIn optimizer, or our mock interviewer, you are communicating with an AI system. You are not talking to a human Four-Leaf employee. The interface labels each AI surface as such, and the system identifies itself as an AI assistant when asked. If you need to speak with a human at Four-Leaf, email team@four-leaf.ai.

Four-Leaf is intended for users 18 years of age or older. See Section 11.

Safety protocol for our AI assistants

Every message sent to a Four-Leaf AI assistant is filtered by an internal chat-safety service before it reaches the underlying model. The service is designed to:

• Refuse content that involves self-harm, suicidal ideation, or serious medical, legal, or financial crises, and instead direct you to qualified professional resources. If you are in the United States and experiencing a mental-health emergency, contact 988 (Suicide and Crisis Lifeline) or call 911. Outside the United States, contact your local emergency number.
• Refuse content that is sexual, illegal, harassing, or otherwise out of scope for a job-search assistant.
• Strip obvious personally identifying patterns (Social Security numbers, full credit-card numbers) from your message before the AI processes it.
• Track refusal patterns per user. Repeated abusive prompts may result in a temporary cooldown or an account-level flag for review.

If you believe an AI response posed a safety risk, please report it to team@four-leaf.ai. We review every reported safety incident.

Use of AI technologies

We provide the AI Products through third-party service providers ("AI Service Providers"), primarily Anthropic. As outlined in this Privacy Notice, your input and the AI's output are shared with and processed by these AI Service Providers to deliver the feature you have requested. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

If you connect Four-Leaf to an outside AI assistant, your data goes there too. Four-Leaf offers a Model Context Protocol (MCP) connector that lets you use tools such as resume tailoring, match scoring, and comp coaching from inside a third-party AI client you already use, for example ChatGPT, Claude, Cursor, or Perplexity. When you choose to connect one, the content you pass through those tools, which can include your resume and job descriptions, is handled by the vendor operating that client under their privacy policy, not ours. We never set this up on your behalf, it requires you to authorize the connection, and you can revoke it at any time from your account settings. If you would rather your resume stayed inside Four-Leaf, do not connect an outside client.

Our AI Products

Our AI Products include:

• Clover. A persistent in-product assistant available to logged-in users. Clover answers product questions and career questions and can point you at the right Four-Leaf tool. Every Clover conversation is logged to your account so you can pick up where you left off and so we can debug and improve the assistant. You can clear your conversation at any time from inside the Clover panel; cleared conversations are soft-deleted and excluded from future context.
• Mock interviews. Voice-enabled practice sessions with an AI interviewer. We record your audio, transcribe it, generate the interviewer's spoken responses, and produce feedback after the session. On paid plans the recording is kept for 30 days so you can replay it; see "Practice recordings and replay" below.
• Resume tailoring and resume parsing. We extract structure from your uploaded resume and use AI to rewrite sections against a target job description.
• Cover letter generation. AI drafts a cover letter from your resume and a target job description.
• Comp negotiation coach. A chat-style coach that helps you evaluate offers and prepare counter-offers.
• Email assistant. Drafts job-search emails (follow-ups, thank-yous, recruiter replies, offer correspondence).
• LinkedIn optimizer. Reviews and rewrites your LinkedIn profile sections.
• AI job search. Matches you to relevant openings using your stated role intent.
• Interview feedback and insights. Analyzes your interview performance and surfaces patterns over time.

How we process your data using AI

All personal information processed by our AI Products is handled in line with this Privacy Notice and our agreements with the AI Service Providers. We do not use your personal information, including resume content, voice recordings, chat conversations, and interview responses, to train artificial intelligence models. Your data is processed by AI services solely to provide you with the requested feature.

Chat conversation logging

Conversations you have with Four-Leaf's AI assistants (Clover, email assistant, comp negotiation coach, LinkedIn optimizer) are stored in your account so you can return to them and so we can analyze quality, debug issues, and improve the product. Each message is associated with your user account and is subject to the access, correction, deletion, and portability rights described in Section 12.

Voice capture and speech processing

When you use a voice-enabled feature such as a mock interview, your browser captures audio while you answer and sends it to us for transcription. The resulting text transcript is saved to your account, where it appears in your interview history and feeds your feedback. Your browser asks permission before the microphone is used, and you can decline and continue with typed answers instead.

Audio is processed by Deepgram for speech-to-text transcription and by Deepgram's Aura service for synthesized interviewer speech. No user biometric identifier (voiceprint, faceprint, or similar) is extracted or stored.

Practice recordings and replay

On paid plans, we also store the recording itself so you can play your practice back: your recorded answers, full mock interview sessions (including the AI interviewer's synthesized voice), and negotiation practice calls. Recordings are stored in private, access-controlled storage tied to your account; only you can play them back, via short-lived signed links. We do not use recordings to train AI models, and we do not share them with anyone.

Recordings are kept for 30 days and then deleted automatically. You can delete individual recordings sooner from the replays list on your Interview Performance dashboard, and deleting your account removes all of them. You can also turn recording storage off entirely under Preferences in your Settings; switching it off deletes the recordings you already have and stops us storing new ones, while transcription and feedback continue to work. On free accounts no recording is stored; audio is transcribed and discarded. Transcripts and feedback generated from your sessions remain stored with your account and are subject to the access, correction, deletion, and portability rights described in Section 12, subject to the limits described in Section 9.

How to opt out

Because the core Services are AI-powered, opting out of AI processing generally means not using those features. To opt out, you can:

• Stop using AI-powered features in your account settings or by not engaging with them.
• Clear individual Clover conversations from the Clover panel.
• Delete your account, which removes the associated data subject to the retention rules in Section 9.

7. How do we handle your social logins?

In short: if you choose to register or log in using a social media account, we may have access to certain information about you.

Our Services offer the ability to register and log in using third-party social accounts (such as Google). When you do this, we receive certain profile information from your social provider. That information typically includes your name, email address, and profile picture, and may include other information you have made public on the platform.

We will use the information we receive only for the purposes described in this Privacy Notice or made clear to you at sign-in. We do not control, and are not responsible for, other uses of your personal information by your social provider. We recommend reviewing their privacy notice and adjusting your privacy settings on their platform.

8. Is your information transferred internationally?

In short: we may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. Regardless of your location, your information may be transferred to, stored by, and processed by us in the United States and by the third-party service providers listed in Section 4.

If you are a resident of the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, those countries may not have data protection laws as comprehensive as your home jurisdiction. We take measures to protect your personal information in accordance with this Privacy Notice and applicable law.

We rely on the European Commission's Standard Contractual Clauses for transfers of personal information between us and our third-party providers. These clauses require recipients to protect personal information originating from the EEA or UK in accordance with European data protection law. Copies are available on request.

9. How long do we keep your information?

In short: we keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless a longer period is required by law.

We keep your personal information only for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or legal obligations). No purpose in this notice will require us to keep your personal information for longer than the period you maintain an account with us.

When we no longer have a legitimate business need to process your personal information, we will either delete or anonymize it, or, if that is not immediately possible (for example, because it is stored in backups), we will isolate it from further processing until deletion is possible.

10. How do we keep your information safe?

In short: we aim to protect your personal information through organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect any personal information we process. No internet transmission or storage technology is 100 percent secure, so we cannot guarantee that unauthorized parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Services is at your own risk. Access the Services only in a secure environment.

Data breach notification

In the event of a data breach affecting personal information, Four-Leaf will notify affected users without undue delay. For users in the EU or EEA, notification will occur within 72 hours as required by GDPR Article 33. Notification will include the nature of the breach, the categories and approximate number of data subjects affected, the data affected, and the remedial steps taken. We will also notify the relevant supervisory authorities as required by applicable law.

11. Do we collect information from minors?

In short: we do not knowingly collect data from or market to children under 18.

We do not knowingly collect or solicit data from anyone under 18 years of age, or the equivalent minimum age in your jurisdiction. By using the Services, you represent that you are at least 18 or the equivalent minimum age in your jurisdiction. If we learn that personal information from a user under that age has been collected, we will deactivate the account and take reasonable steps to delete the data promptly. If you become aware of any such data, please contact us at team@four-leaf.ai.

12. What are your privacy rights?

In short: depending on where you live, you may have rights that allow you greater access to and control over your personal information.

In some regions (such as the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right to:

• Request access to and obtain a copy of your personal information
• Request rectification or erasure
• Restrict the processing of your personal information
• Data portability, where applicable
• Object to automated decision-making

If a decision producing legal or similarly significant effects is made by automated means, we will inform you, explain the main factors, and offer a way to request human review.

You can exercise any of these rights by emailing us at team@four-leaf.ai. We will consider and act upon every request in accordance with applicable data protection laws.

If you are in the EEA or UK and believe we are unlawfully processing your personal information, you can also complain to your Member State data protection authority or the UK Information Commissioner's Office. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

If we are relying on your consent to process your personal information, you have the right to withdraw consent at any time by emailing us at team@four-leaf.ai or by updating your preferences in your account. Withdrawal does not affect the lawfulness of any processing carried out before the withdrawal, nor does it affect processing carried out on lawful grounds other than consent.

Opting out of marketing and promotional communications

You can unsubscribe from marketing emails at any time using the unsubscribe link in the email, or by contacting us. We may still send service-related messages necessary to administer your account, respond to service requests, or for other non-marketing purposes.

Account information

To review or change information in your account or to terminate the account, you can:

• Log in to your account settings and update your information
• Contact us using the contact information provided

On your request to terminate your account, we will deactivate or delete it and the associated information from our active databases. We may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal requirements.

Cookies and similar technologies

Most browsers accept cookies by default. You can set your browser to remove or reject cookies, but doing so may affect certain features of the Services. For details, see our Cookie Notice.

Questions about your privacy rights? Email us at team@four-leaf.ai.

13. Universal opt-out signals and Do-Not-Track

Global Privacy Control and universal opt-out mechanisms

Several US state privacy laws (including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas) require businesses that sell or share personal information for cross-context behavioral advertising, or that engage in targeted advertising, to recognize universal opt-out mechanisms such as Global Privacy Control ("GPC").

Four-Leaf does not sell your personal information and does not share it for cross-context behavioral advertising. Because we do not engage in either of those activities, GPC and similar signals do not change how we process your data. If we ever begin to sell or share personal information, we will treat a detected GPC signal as a valid opt-out request and update this notice accordingly.

Do-Not-Track

Most web browsers include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference. No uniform technology standard for recognizing or implementing DNT signals has been finalized, and California law only requires us to let you know how we respond. Because there is no industry or legal standard for honoring DNT signals, we do not respond to them. If a standard is adopted that we must follow, we will inform you in a revised version of this notice.

14. Do United States residents have specific privacy rights?

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you have specific privacy rights described below.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve months. The table includes illustrative examples and does not reflect every piece of personal information collected from a given user. For a complete inventory, see Section 1.

Categories of sources

We collect the categories above from the following sources:

• Directly from you when you register, complete your profile, upload a resume, paste a job description, record a mock interview, or send a chat message to one of our AI assistants.
• Automatically from your device and browser when you interact with the Services (log data, IP address, approximate geolocation, cookies and similar technologies).
• From third-party providers when you choose to sign in with a third-party account (for example, Google), and from our payment processor (Stripe) when you complete a subscription transaction.

Business or commercial purposes for collection

We collect the categories above for the following business and commercial purposes, as defined under California Civil Code Section 1798.140:

• To provide, support, personalize, and develop the Services
• To create and maintain your account and authenticate your sign-in
• To process payments and manage your subscription
• To deliver AI-powered features (resume tailoring, cover letters, mock interviews, the Clover assistant, comp negotiation, email drafting, LinkedIn optimization, AI job search, and interview feedback)
• To respond to support requests and operational communications
• To detect, prevent, and address fraud, abuse, security incidents, and technical problems
• To comply with our legal obligations and enforce our terms
• To analyze use of the Services in aggregate so we can improve them

Retention

We retain each category of personal information only as long as necessary to provide the Services and to fulfill the purposes described in this notice, or for a longer period if required by law. The general criteria we use to determine retention are:

• Account and profile data, application records, resume content, and chat conversations: retained while your account is active. Cleared on account deletion (subject to backups, fraud-prevention, and legal-hold requirements).
• Audio from mock interviews: not retained. Audio is transcribed and discarded during the session. The transcript is kept with your account and is deleted when you delete your account (subject to backups and legal-hold exceptions).
• Payment data: handled and retained by Stripe under its own retention policy; we retain only minimal transaction metadata while the account is active.
• Log and usage data: retained for as long as necessary for security, debugging, and product analytics, and deleted when no longer needed for those purposes. Retention periods may be shorter where set by our infrastructure providers' defaults (for example, Vercel, Sentry, PostHog).

Categories of recipients

We disclose the categories above to the following categories of recipients for the business purposes described:

• AI service providers (for example, Anthropic for generative AI; Deepgram for speech processing) to deliver AI-powered features
• Cloud infrastructure and database providers (Vercel, Supabase) to host and operate the Services
• Payment processors (Stripe) to process transactions
• Identity providers (Google) when you elect social login
• Analytics and product-instrumentation providers (PostHog, Google Analytics) and error-monitoring providers (Sentry) for aggregate usage analysis and debugging
• Email delivery providers (Resend, and Svix for webhook verification) to send you account and lifecycle email
• Internal alerting tools (Slack) to notify our team of account activity
• Job search data providers (SerpAPI) to return results for the roles you search
• Identity providers (Google, LinkedIn) when you elect social login

We have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve months, and we do not have actual knowledge of any sale or sharing of personal information of minors under 16 years of age.

Your rights

Depending on your state of residence, you may have the following rights under US state data protection laws. These rights are not absolute and in certain cases we may decline a request as permitted by law.

• Right to know whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of personal data you previously shared
• Right to non-discrimination for exercising your rights
• Right to opt out of processing for targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects

Depending on your state, you may also have rights to:

• Access the categories of personal data being processed (Minnesota)
• Obtain a list of the categories of third parties to which we have disclosed personal data (California, Delaware, Maryland)
• Obtain a list of specific third parties to which we have disclosed personal data (Minnesota, Oregon)
• Obtain a list of third parties to which we have sold personal data (Connecticut)
• Review, understand, and (where allowed) correct how personal data has been profiled (Connecticut, Minnesota)
• Limit use and disclosure of sensitive personal data (California)
• Opt out of the collection of sensitive data and personal data collected through voice or facial recognition features (Florida)

How to exercise your rights

To exercise these rights, email us at team@four-leaf.ai. You can designate an authorized agent to make a request on your behalf under certain state laws. We may deny an agent's request that does not include proof of valid authorization.

Request verification

When we receive a request, we will verify your identity to confirm you are the person about whom we have information. We will only use personal information you provide in the request to verify your identity or authority to make the request. If we cannot verify your identity from existing information, we may request additional verification information.

Appeals

If we decline to take action on your request and you live in a state with an appeal right, you may appeal by emailing us at team@four-leaf.ai. We will respond in writing within the time required by your state's law and explain the reasons for any decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine the Light" law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes in the prior calendar year, and the names and addresses of those third parties. To make such a request, email us at team@four-leaf.ai.

15. Do we make updates to this notice?

In short: yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we may notify you by prominently posting a notice or by sending you a direct notification. We encourage you to review this notice frequently.

16. How can you contact us about this notice?

If you have questions or comments about this notice, or you want to exercise any of the rights described above, email us at team@four-leaf.ai. Four-Leaf operates entirely online, so email is the designated method for submitting privacy requests and we answer every one of them from that address.

17. How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect, to ask how we have processed it, to correct inaccuracies, or to delete it. You may also have the right to withdraw consent to our processing. These rights may be limited in some circumstances by applicable law. To make a request, email us at team@four-leaf.ai.

Accessibility

If you need this Privacy Notice in an alternative accessible format (large print, screen-reader-optimized document, or another reasonable accommodation), email team@four-leaf.ai and we will provide it without charge.