Winslow Privacy Policy

Winslow AI, Inc. ("Winslow," "we," "us") provides an AI-powered sales-coaching platform for financial professionals. This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have.

This policy is written to grow with our product. It has a general core (the sections below) plus service-specific sections we will add as we launch new offerings. When we add a new service, we will describe its data practices in a dated addition rather than by silently changing this policy.

1. Who this policy covers, and our two roles

This policy applies to our website at gowinslow.ai, our application at app.gowinslow.ai, our meeting notetaker, and the services we make available (which may expand over time).

Winslow acts in two different roles depending on whose information is involved, and this distinction runs through the whole policy:

• When we handle information about you as a Winslow user (a financial advisor or firm that uses our platform), we are the controller/business — we decide how that information is used, as described here.
• When we handle information about your clients and prospects that is captured in your meetings, we act as your service provider/processor — we process it only on your instructions and on your behalf, to provide the coaching service. We do not treat that client information as ours to repurpose. It remains governed by your own privacy notices and your obligations under financial-privacy law (such as the Gramm-Leach-Bliley Act).

If you are a client or prospect of an advisor who uses Winslow and you have a request about your information, please contact that advisor (the party responsible for your data); we will support them in responding.

2. Information we collect

Information you provide

• Account and profile information: name, business email, phone, company, role, and login credentials (via our authentication provider).
• Knowledge-base and settings: company and advisor context you enter, custom templates, and configuration choices.
• Support communications: messages you send us.

Meeting content (via our notetaker)

• Audio, video, and transcripts of meetings you record using Winslow. These recordings can contain sensitive information about your clients and prospects, including personal financial details. We treat this content as confidential and highly sensitive.
• We identify who is speaking based on meeting participant/audio-stream information (for example, which participant's microphone the audio comes from). We do not use facial recognition and we do not create voiceprints or other biometric identifiers.

Information created by the service

• AI analyses and derived data: coaching scores, scorecards, summaries, and supporting quotes generated from your meetings.

Information collected automatically

• Usage, device, and log data: how you interact with the app, IP address, browser/device type, and timestamps.
• Cookies and similar technologies on our public website (see Section 7).

Billing information

• We use a third-party payment processor (Stripe) to handle payments. We store billing identifiers (such as customer and subscription IDs) and plan/usage records; we do not store full payment-card numbers — those are handled by our processor.

Integration data

• When you connect a meeting platform (Zoom, Microsoft Teams, Google Meet), we store the access credentials needed to provide the service, in encrypted form.

We do not intentionally collect special-category data (such as health, biometric, or government-ID information), and we ask you not to input it.

3. Where the information comes from

We collect information: (a) directly from you; (b) from the meetings our notetaker joins on the platforms you connect; (c) automatically through cookies and similar technologies on our public website; and (d) from our service providers (for example, authentication, payment, and meeting-recording vendors).

How our meeting notetaker and platform integrations work

When you connect a meeting platform — such as Zoom, Microsoft Teams, or Google Meet — and choose to record a meeting, Winslow uses a third-party meeting-recording infrastructure provider to join and capture the meeting on your behalf. Here is how it works and what you should know:

• A visible bot joins the meeting. Our notetaker appears in the participant list, so everyone on the call can see the meeting is being recorded. You remain responsible for obtaining any consents required from participants (see Section 11).
• What is captured. Depending on the meeting, this can include the meeting's audio, video, transcript, participant names and email addresses, and meeting metadata (such as title, date, and duration).
• How speakers are identified. Our recording provider captures each participant's audio as a separate stream, which is how transcripts show who said what. This relies on the meeting's participant and audio-channel information — not on facial recognition, voiceprints, or any other biometric identifier.
• Processing and storage by our provider. The recording provider processes this data to deliver it to Winslow. We configure the provider to store data in the United States and to retain it only as long as needed to deliver it to us (including options that minimize or avoid provider-side storage). Winslow then stores the meeting content in your account as described in this policy.
• Platform terms. Winslow and our recording provider operate in accordance with the applicable terms of the meeting platforms you connect (Zoom, Microsoft Teams, and Google Meet).

We only capture the meetings you choose to record, and you can delete recordings and transcripts at any time (see Section 8).

4. How we use information

We use personal information to:

• Provide the service — join your meetings, transcribe them, and generate AI coaching analyses.
• Operate your account — authentication, settings, support, and communications about the service.
• Process payments and manage subscriptions.
• Secure and maintain the platform, prevent abuse, and troubleshoot. A limited group of authorized Winslow personnel may access meeting content only as needed for support, quality assurance, and debugging.
• Improve our services. We may create de-identified and aggregated data from meetings and usage, and use it to improve and benchmark our services (current and future). We maintain this data so that it cannot reasonably be used to re-identify any individual, and we do not attempt to re-identify it.
• Comply with law and enforce our terms.

How AI is used. To generate your coaching feedback, your meeting transcripts are sent to and processed by a third-party AI provider on that provider's systems, under a commercial agreement with data-protection terms. Under those terms, the provider does not use your content to train its AI models and uses it only to perform the analysis for us. The provider may retain content for a limited period to detect and prevent abuse and to maintain security. Your content is encrypted in transit to the provider. This is a standard commercial AI service — it is not a dedicated or self-hosted model — but in all cases your content is used only to provide the service to you, never to train the provider's models or for advertising.

We do not use identifiable client information to train our own models, and we do not use meeting content for advertising.

5. Financial-privacy (GLBA) framework

Because our users are financial professionals, meeting content may include clients' nonpublic personal information under the Gramm-Leach-Bliley Act (GLBA). For that information, Winslow acts as a service provider and uses it only to provide the coaching service to the advisor — never for our own independent purposes. The advisor remains the party responsible for its clients' information and for its own privacy notices and recordkeeping obligations.

6. How we share information

We share personal information only as described here:

• Service providers (subprocessors). We share information with vendors that help us run the platform — a third-party AI provider (analysis), a meeting-recording infrastructure provider (to join and capture your meetings), authentication, payment processing, and cloud hosting. They are bound by contract to protect the information and use it only to provide services to us. A current list of subprocessors is available on request.
• Advertising partners — public website only. On our public website (gowinslow.ai), we use advertising and analytics technologies (including a pixel) to reach and retarget prospective advisors. Under California law, this activity is considered "sharing" for cross-context behavioral advertising. We do not use these technologies to target your clients or prospects, and they do not operate inside the logged-in application. You can opt out (see Section 7).
• Legal and safety. We may disclose information to comply with law, legal process, or lawful requests, or to protect the rights, safety, and security of Winslow, our users, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

We do not sell, and do not share (except for the public-website advertising described above), your Service data — meaning your meeting content, transcripts, audio, video, analyses, and information about your clients and prospects. This is an ongoing commitment that also applies to services we add in the future.

7. Cookies, pixels, and your advertising choices

On our public website we use cookies and similar technologies for essential functionality, analytics, and advertising (including retargeting advisors). Some of these constitute a "sale" or "share" under certain U.S. state laws.

You can control this by:

• Using the "Do Not Sell or Share My Personal Information" link on our website;
• Enabling a browser Global Privacy Control (GPC) signal, which we honor as an opt-out; and
• Adjusting your cookie preferences in our cookie banner.

These advertising technologies do not run inside the logged-in application (app.gowinslow.ai).

8. How long we keep information

We keep personal information only as long as needed to provide the service, meet legal and tax obligations, resolve disputes, and enforce our agreements. The table below summarizes our retention periods.

When a retention period ends, we securely delete or irreversibly de-identify the data, including copies held in backups. You can request earlier deletion at any time by emailing privacy@gowinslow.ai, subject to legal retention requirements. If your firm is subject to recordkeeping rules, you are responsible for choosing retention settings consistent with those obligations.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including: encryption in transit and at rest, access controls, multi-factor authentication, restricting meeting-content access to a limited group of authorized personnel, logging and monitoring, and vendor security oversight. No system is perfectly secure, but we work to protect your information and will notify affected customers of a security incident without undue delay, consistent with our contractual commitments and applicable law.

10. Your privacy rights

Depending on where you live, you may have rights to:

• Access / know what personal information we hold about you;
• Delete your personal information;
• Correct inaccurate information;
• Opt out of the "sale" or "sharing" of personal information for advertising;
• Limit the use of sensitive personal information;
• Data portability; and
• Non-discrimination for exercising your rights.

How to exercise your rights. Email us at privacy@gowinslow.ai. We will verify your request and respond within the timeframes required by law. You may use an authorized agent where permitted. If your request is denied, you may appeal by replying to our response.

Client/prospect requests. If you are a client or prospect of an advisor who uses Winslow, we act as that advisor's service provider — please direct your request to the advisor, and we will assist them.

California. California residents have the rights above under the CCPA/CPRA. We do not sell or share Service data; our public-website advertising activity is described in Sections 6–7, with opt-out options provided.

Canada. If you are in Canada, you have rights of access and correction under PIPEDA. See Section 11 regarding cross-border processing.

11. Recording, consent, and international processing

Recording consent. Winslow's notetaker joins meetings as a visible participant and records audio, video, and transcripts at the direction of the account user. The user is responsible for obtaining consent from all meeting participants to be recorded and processed by an AI tool, as required by applicable law. We provide features to help disclose recording and capture consent.

Where we process data. We operate in the United States, and personal information is processed and stored in the United States. If you are located in Canada, your information will be transferred to and processed in the United States, which may have different data-protection laws; we take reasonable steps to protect information transferred across borders. The Winslow service is not currently offered to residents of Quebec.

12. Marketing communications

If we send you marketing emails, you can unsubscribe at any time using the link in the email. For recipients in Canada, we follow Canada's Anti-Spam Legislation (CASL), including obtaining consent, identifying ourselves, and honoring unsubscribe requests.

13. Eligibility

Winslow is intended for use by financial professionals aged 18 or older. The service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child's information has been provided to us, contact privacy@gowinslow.ai and we will delete it.

14. Changes to this policy

We may update this policy as our services evolve. Every version is dated and archived. For material changes, we will provide advance, prominent notice (by email and/or in the app) and obtain fresh consent where the law requires it. When we launch a new service, we will disclose its data practices by adding a service-specific section — not by silently rewriting this policy. We will not retroactively apply materially different uses to previously collected information without the notice and consent the law requires.

15. Contact us

Winslow AI, Inc. Attn: Privacy Officer [Company mailing address] Email: privacy@gowinslow.ai

Questions or requests about this policy or your personal information? Contact us at privacy@gowinslow.ai.