Effective as of 19th of June 2025

This Privacy Policy describes how Arva AI, Inc. (“Arva AI,” “we,” “us,” or “our”) handles personal information we collect through our website, products, and services that link to this policy (collectively, the “Service”), as well as through our marketing activities, business operations, and external integrations.

Personal Information We Collect

We collect information from various sources:

Information you provide to us:

• Contact data (e.g., name, email, job title, company)

• Account data (e.g., login credentials, preferences)

• KYB/AML data (e.g., identity documents, business registration, beneficial ownership)

• Communications and feedback

Third-party sources:

• Public databases and registries

• Business data aggregators

• Sanctions/watchlist sources

• Social platforms

Automatically collected data:

• Device and browser details

• Usage metrics and interactions (strictly for our platform product and not our primary website)

• Cookies and analytics data (via Google Analytics)

How We Use Your Personal Information

We use your information for the following purposes:

Service Delivery:

• Operate and maintain our AML/KYB services

• Verify business and individual identities

• Manage accounts and access controls

• Send service-related updates and notifications

Research and Development:

• Analyse platform usage and improve our products

• Test and optimise features

Compliance and Protection:

• Respond to lawful legal requests

How We Share Your Personal Information

We may share your information with:

• Service providers (e.g. hosting, analytics, identity verification, compliance tools)

• Public data vendors (e.g. corporate registries)

• Professional advisors (e.g. legal, accounting)

• Authorities and regulators when required by law

• Business transferees in the event of an acquisition or merger

We do not sell your personal information.

Your Choices

• Access and update: You can view or correct account information at any time.

• Cookies: You can manage cookies via browser settings.

• Do Not Track: We do not currently respond to DNT signals.

Other Sites and Services

Our Service may link to third-party platforms or services. We do not control their privacy practices and encourage you to review their privacy policies before interacting with them.

Security

We implement administrative, technical, and physical safeguards to protect your data.

International Data Transfer

We are based in the United States and may work with service providers or partners globally. We have separate regions setup to ensure that for the majority of cases, no data has to be transferred out of your desired jurisdiction. However, when there are rare exceptions , your personal information may be transferred to and processed in jurisdictions that may not provide equivalent levels of data protection as your home country. When doing so, we use appropriate safeguards, such as Standard Contractual Clauses, where required.

Children

Our Service is not intended for children under 18. If we learn that we’ve collected personal information from a minor without appropriate consent, we will delete it as required by law.

Changes to This Privacy Policy

We may update this Privacy Policy periodically. If we make material changes, we’ll notify you by updating the effective date and, where appropriate, through other channels.

How to Contact Us

Email: privacy@arva.ai

California Privacy Rights Notice

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal data we collect and how we use it

• The right to request access or deletion of your data

• The right to non-discrimination for exercising your rights

You may exercise these rights by emailing privacy@arva.ai. We will verify your identity before processing requests. We do not sell your personal information.

Exercising your right to information, access and deletion. You may submit requests to exercise your right to information, via email to privacy@arva.ai.

We will need to verify your identity to process your information, access and deletion requests and reserve the right to confirm your California residency. To verify your identity, we may require government identification, a declaration under penalty of perjury or other information. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

Your authorized agent may make a request on your behalf upon our verification of the agent’s identity and our receipt of a copy of a valid power of attorney given to your authorized agent pursuant to California Probate Code Sections 4000-4465. If you have not provided your agent with such a power of attorney, you must provide your agent with written and signed permission to exercise your CCPA rights on your behalf, provide the information we request to verify your identity, and provide us with confirmation that you have given the authorized agent permission to submit the request.