Privacy Policy

Effective Date: November 11, 2025

This Privacy Policy (“Policy”) is to be read in conjunction with the Terms of Use displayed on our Platform/Website and establishes a legally binding agreement between you (“User”) and CereBree Inc. (“the Company”, CereBree, “we”, “us”, “our”).

By accessing or using our Platform, you acknowledge that you have read, understood, and agree to this Privacy Policy.

If you do not agree, please discontinue use of our Services.

At CereBree, we are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (cerebree.com), mobile applications, dashboard, API services, AI tools, blockchain integrations, and any related products or services (collectively, the “Services”).

CereBree operates globally with entities in United Arab Emirates, Germany, United States, and India. We comply with applicable data protection laws in each jurisdiction, including:

• GDPR (EU/Germany)
• DIFC Data Protection Law (UAE)
• CCPA/CPRA (USA)
• Digital Personal Data Protection Act (India)

1. What Personal Data May be Collected

In the course of providing our Services, CereBree may collect the following categories of personal information from you: All such information is collected only for lawful purposes and in accordance with this Privacy Policy.

A. Data You Provide Directly

• Personal Details: CereBree may collect personal details including but not limited to your full name, email address, phone number or other identifiers required to establish your account or verify your identity.
• Contact Information: This may include your email address, telephone number, and postal address for the purpose of communication, account access, and customer support.
• Professional Profile: Information such as your résumé, work history, education, skills, job preferences and any other details you voluntarily submit to build or enhance your professional profile.
• Account Information: Username, hashed password, and related credentials necessary for secure access to the Platform and Services.
• Payment Information: Information required to process transactions may be collected. All payments are handled through secure third-party providers.
• Communications: Content of your messages, queries, feedback, or other correspondence with us through chat, email, or support channels.

B. Data Collected Automatically

Certain information is automatically gathered when you interact with our Platform, such as

• IP address, browser type, device identifiers, operating system,
• Pages visited, time spent on site, and click patterns.
• Analytics data (aggregated and anonymized)

C. Web3 and Blockchain Data

CereBree may collect your

• Public wallet address (if you connect a wallet)
• On-chain activity (e.g., bounty claims, token interactions) — public by design on blockchain

D. AI Model Improvement (Optional)

• With your explicit consent, anonymized usage patterns may be used to improve AI performance

CereBree does not intentionally collect sensitive personal information such as health data, racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data unless you have explicitly consented or such collection is mandated by law.

You agree to provide accurate and complete information. CereBree shall not be liable for any loss or consequence arising from false or inaccurate information voluntarily provided by you. We collect this information directly from you when you use our Services, automatically through cookies and similar technologies, or via third-party integrations and platforms where you have authorized data sharing.

3. How We Use Your Personal Data

The personal information collected by CereBree is used solely for lawful purposes, in accordance with applicable data protection laws. We process such information to provide, improve, and secure our Services, and to comply with our legal and contractual obligations.

CereBree may use your personal information for the following purposes:

1. To Provide and Improve Services:: To create and maintain your account, enable access to our Platform, and deliver the features and functionalities of our Services. This processing is necessary for the performance of our contract with you.
2. To Manage Subscriptions and Payments:: To process payments, manage billing, verify transactions, and prevent fraud. Such processing is based on the performance of a contract and legal obligations relating to financial compliance.
3. o Communicate with You:: To send updates, confirmations, technical notices, and support responses regarding your use of the Services. This is carried out under our legitimate interest to provide you with efficient customer service and maintain the security of your account.
4. To Personalize Your Experience:: To provide tailored recommendations, job or project matches, and customized content. Such processing is based on your consent or our legitimate interest in improving user engagement.
5. To Maintain Platform Security and Prevent Misuse:: To monitor activity, detect suspicious behavior, investigate potential violations, and protect against unauthorized access, cyber threats, or abuse. This is based on our legitimate interest in maintaining the integrity of our Services.
6. To Comply with Legal and Regulatory Obligations:: To meet obligations under applicable laws, including tax, accounting, anti-money laundering, and data protection regulations. This processing is based on our legal obligations.
7. To Conduct Research and Analytics: To analyze usage trends, measure performance, and develop new features or improvements. Such analysis is conducted on anonymized or aggregated data and based on our legitimate interests.
8. To Improve AI Models (Optional): With your explicit consent, anonymized usage data may be analyzed to enhance the performance and accuracy of CereBree’s artificial intelligence tools.

4. How Long Will the Personal Data Collected Be Retained by the Company

CereBree retains your personal data only for as long as it is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The retention period varies depending on the type of data, the purpose of processing, and legal or regulatory requirements.

The following general retention periods apply:

1. Account Data: Retained until you delete your account or for up to three (3) years thereafter, to enable record-keeping, dispute resolution, and compliance with contractual or legal obligations.
2. Payment and Financial Records: Retained for the duration required under applicable tax, accounting, and financial laws in each jurisdiction where CereBree operates.
3. Support Logs and Communications: Retained for up to one (1) year from the date of your last interaction, to help us resolve issues, improve support quality, and prevent abuse.
4. Backup Data: Maintained for a maximum of thirty (30) days before secure deletion or automated overwriting, unless otherwise required for system integrity or legal compliance.

CereBree determines retention periods by considering the nature and sensitivity of the data, the risk of harm from unauthorized disclosure, the purposes of processing, and any legal retention obligations applicable in different jurisdictions.

After the relevant retention period expires, all personal data is securely deleted, anonymized, or aggregated to ensure it can no longer be associated with an identifiable individual.

You may request deletion of your personal data at any time by contacting legal@cerebree.com. Such requests will be honored subject to CereBree’s legal or regulatory data retention obligations.

5. Whom Does the Company Share Your Personal Data With

CereBree values your privacy and does not sell or trade your personal data. We may, however, share limited information with trusted parties when it is necessary to operate our Services, meet our legal obligations, or protect our legitimate interests. All such sharing is done in accordance with this Privacy Policy and applicable data-protection laws.

CereBree may share your personal data with the following categories of recipients:

1. Trusted Service Providers: Third-party vendors who assist us in delivering our Service such as cloud-hosting platforms, payment gateways, analytics tools, and customer-support providers. These entities process personal data only under written agreements that impose confidentiality and data-protection obligations consistent with applicable laws.
2. Blockchain Networks: Public wallet addresses and related on-chain transactions may be visible on the blockchain by design. CereBree does not control or restrict access to data recorded on public ledgers.
3. Business Partners and Affiliates: Where CereBree collaborates with affiliates or integration partners to provide combined offerings or enterprise services, relevant data may be shared strictly for those purposes and subject to equivalent privacy safeguards.
4. Legal and Regulatory Authorities: Information may be disclosed when required by law, regulation, court order, or competent governmental request, or to protect CereBree’s rights, property, or the safety of users and the public.
5. Professional Advisers: External auditors, legal counsel, accountants, and consultants may access limited data where necessary to provide professional or compliance services under confidentiality obligations.
6. Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity. CereBree will ensure that such successor continues to process your information consistent with this Policy and will notify you in advance of any material change.

All third-party recipients are contractually bound to implement adequate technical and organizational measures to safeguard your personal data and may process it only on CereBree’s documented instructions.

6. Your Data Protection Rights

As the data subject, you have certain rights in relation to the personal data that CereBree holds about you. These rights can be exercised at any time, subject to applicable laws and the terms outlined below.

You may exercise these rights by writing to us at legal@cerebree.com. CereBree will respond to all valid requests within one (1) month and may extend this period by up to two additional months for complex or numerous requests, in which case you will be notified of the reason for the delay.

1. Right to Access
   You have the right to obtain confirmation as to whether or not we process your personal data and, if so, to access that data along with information regarding the purposes of processing, categories of data involved, and the recipients or categories of recipients with whom the data is shared.
2. Right to Rectification
   You may request correction or update of any inaccurate or incomplete personal data concerning you to ensure it remains accurate and current.
3. Right to Erasure (“Right to Be Forgotten”)
   You may request deletion of your personal data where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where the processing is unlawful, subject to CereBree’s legal and regulatory retention obligations.
4. Right to Restrict Processing
   You may request that we restrict processing of your personal data under certain circumstances, such as while the accuracy of data is contested or where processing is unlawful and you oppose deletion.
5. Right to Data Portability
   You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
6. Right to Object
   You may object, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests. We will cease such processing unless we demonstrate compelling legitimate grounds which override your interests, rights, and freedoms.
7. Right to Withdraw Consent
   Where processing is based on consent, you may withdraw that consent at any time by emailing legal@cerebree.com. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal.
8. Right to Lodge a Complaint
   If you believe your rights under data-protection laws have been infringed, you may lodge a complaint with your local data-protection authority.

7. How Do We Protect Your Information

CereBree is committed to safeguarding your personal data and maintaining the confidentiality, integrity, and availability of all information we process.

We implement a combination of physical, technical, and organizational security measures designed to protect your data against unauthorized access, alteration, disclosure, or destruction.

Our security framework includes, but is not limited to, the following measures:

• Encryption: All data is encrypted both in transit (TLS) and at rest (AES-256) to prevent interception or unauthorized access.
• Access Controls: Strict role-based access management ensures that only authorized personnel have access to personal data necessary for their job functions.
• Password Protection: All account passwords are securely hashed and stored using industry-standard cryptographic methods.
• Monitoring and Testing Regular security audits, vulnerability assessments, and penetration tests are conducted to identify and mitigate potential risks.
• Employee Confidentiality All employees and contractors handling personal data are bound by strict confidentiality obligations and receive ongoing data-protection training.
• Incident Response A documented Data Breach Response Plan is in place to ensure timely detection, reporting, and mitigation of security incidents in accordance with applicable laws.

While CereBree takes strong precautions and follows recognized industry standards, no system can guarantee absolute security. The nature of the internet involves inherent risks, and therefore CereBree cannot be held responsible for unauthorized access beyond its reasonable control.

8. International Data Transfers

You acknowledge that CereBree may need to process your data in UAE, Germany, USA, or India. As a result, You consent that your personal data may be transferred to and processed in countries other than the one in which you reside. These jurisdictions may have different data-protection standards, However, We use Standard Contractual Clauses (SCCs) and other approved mechanisms to ensure adequate protection during cross-border transfers.

9. Children’s Privacy

CereBree’s Services are intended for use by individuals who are legally capable of providing consent under applicable data-protection laws. We do not knowingly collect, process, or store personal data from children below the minimum age prescribed in their jurisdiction.

• For users located in the European Union, CereBree does not knowingly collect data from individuals under the age of 16.
• For users located in the United States, CereBree complies with the Children’s Online Privacy Protection Act (COPPA) and does not knowingly collect information from individuals under the age of 13.
• For users in other jurisdictions, local laws governing the minimum age of consent for data processing shall apply.

If CereBree becomes aware that personal data has been inadvertently collected from a child who does not meet the applicable age requirement, we will take immediate steps to delete such information from our systems.

10. Third-Party Websites

Our Platform and Services may contain links to third-party websites, applications, or services that are not owned or controlled by CereBree. These external sites operate under their own privacy practices and terms of use, which may differ from ours.

CereBree does not assume responsibility for the privacy, security, or data-handling practices of such third parties. When you choose to access or interact with these websites, any information you provide is governed by their respective privacy policies, not this Privacy Policy.

We encourage you to carefully review the privacy statements of any third-party website or service you visit before sharing personal data or engaging with their offerings.

11. Data Breach Response

CereBree takes the protection of your personal data very seriously. Despite implementing strong technical and organizational safeguards, unforeseen security incidents may occur. In such cases, CereBree follows a clearly defined breach-response protocol to minimize impact and ensure transparency.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, CereBree will:

• Identify and Contain the Breach: Immediately investigate the nature and scope of the breach, secure affected systems, and prevent further unauthorized access.
• Assess the Risk: Evaluate the potential impact of the breach on individuals and the data involved.
• Notify the Authorities: Report the incident to the relevant data protection authority within seventy-two (72) hours of becoming aware of the breach, where required by law.
• Inform Affected Users: When legally required or deemed necessary for transparency, CereBree will notify affected individuals without undue delay, outlining the nature of the breach, the data affected, and recommended protective steps.
• Mitigate and Prevent Recurrence: Take corrective measures to minimize future risk, such as strengthening system controls, retraining personnel, or revising internal procedures.

CereBree remains committed to maintaining transparency and accountability in the event of any security breach and ensuring compliance with all applicable data-protection laws.

12. Termination and Data Access

Upon termination or deactivation of your account, CereBree will take reasonable steps to ensure that your personal data is handled securely and in accordance with this Privacy Policy.

• Access After Termination: You may request a copy of your personal data within thirty (30) days of account termination or deactivation. After this period, CereBree may delete or anonymize the data, except where retention is required by law or legitimate business need.
• Retention Post-Termination: Certain data, such as transaction records or correspondence necessary for legal, accounting, or regulatory compliance, may be retained for the duration required by applicable laws in each jurisdiction.
• Deletion and Anonymization: Once the retention period expires, all personal data associated with your account will be permanently deleted or irreversibly anonymized from CereBree’s active systems and backups.

If you wish to terminate your account or request data access following termination, please contact us at legal@cerebree.com.

13. Changes to This Privacy Policy

CereBree may revise or update this Privacy Policy from time to time to reflect changes in legal requirements, technological developments, or our data-handling practices. The most recent version of the Policy will always be available on our Platform and will indicate the date of last update at the top of this document.

When material changes are made to the Policy that may significantly affect your rights or the manner in which your personal data is processed, CereBree will:

Provide advance notice of such changes through email, in-app notifications, or a public announcement on our Platform; and

Indicate the effective date of the updated Privacy Policy to ensure transparency and informed consent.

Your continued use of the Services after the effective date of any revised Policy constitutes your acceptance of those changes. If you do not agree to the modifications, you should discontinue use of our Services and contact us to deactivate your account, if applicable.

CereBree maintains archived copies of previous versions of this Policy for reference and transparency. You may request access to prior versions by contacting legal@cerebree.com.

14. Governing Law and Jurisdiction

These Terms are governed by the laws of the United Arab Emirates (for users in UAE), Germany (for EU users), California, USA (for US users), or India (for Indian users), as applicable based on your primary location of use.

15. Automated Decision-Making and Profiling

CereBree does not engage in any form of automated decision-making, including profiling, that produces legal effects concerning you or significantly affects you.

Any personalization features (such as recommendations, content suggestions, or AI-generated insights) are designed solely to enhance your user experience and are not used for decision-making that may impact your rights, obligations, or access to services.

If CereBree introduces automated decision-making processes in the future, you will be informed in advance, along with details of the logic involved, the significance of such processing, and the potential consequences for you.

You may request human review of any automated processing that materially affects you, or opt out of such processing where permissible under law.

16. Contact Us

For privacy questions or to exercise your rights:
legal@cerebree.com

For more information on how we use cookies and similar technologies, please review our Cookie Policy.