Lunaseed Inc.

Effective Date: March 20th, 2026

Registered Office: 6221 Cypress Ave, El Cerrito, California, United States

This Policy explains how we collect, secure, and share your information when you use the Lunaseed Platform.

Lunaseed Inc. ("Lunaseed," "we," "us," or "our") provides a platform that helps startups, founders, investors, and related users manage onboarding, validation, diligence, communications, document workflows, verification, and related platform services (collectively, the "Platform").

This Privacy Policy explains how we collect, use, store, disclose, and protect information when you visit our website, create an account, submit information, connect third-party services, use our diligence and validation tools, communicate through the Platform, or otherwise interact with Lunaseed.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Scope of This Privacy Policy

This Privacy Policy applies to:

visitors to our public website;
founders, startups, investors, and representatives using the Platform;
users who submit forms, documents, diligence materials, verification information, or communications to us;
users whose information is processed through our integrations, service providers, or AI-enabled workflows.

This Privacy Policy does not apply to third-party websites, services, or platforms that are not controlled by Lunaseed, even if they are linked from our Platform.

2. Information We Collect

We collect information directly from you, automatically from your device and use of the Platform, from your organization or other users, and from third-party service providers and integrations.

A. Information You Provide Directly

Account and contact information

• full name
• email address
• phone number
• mailing address
• company name
• job title
• login credentials or authentication-related information

Identity and verification information

• date of birth
• government-issued identification details
• ID images or scans
• selfie or biometric verification outputs where provided by verification vendors
• accreditation-related information
• KYC / KYB verification information

Company and diligence information

• legal entity name
• incorporation documents
• certificates of incorporation or formation
• EIN confirmation materials
• cap tables
• governance documents
• financing documents
• due diligence materials
• investor updates
• startup metrics
• uploaded business records, policies, technical materials, compliance materials, and related files

Financial and transaction-related information

• bank account verification data
• linked financial account metadata
• payment-related information
• billing information
• subscription information
• transaction records
• investment workflow information

Communications and content

• messages sent through the Platform
• support inquiries
• email correspondence
• comments, requests, replies, attachments, and other content you submit

B. Information Collected Automatically

• IP address
• browser type and version
• device type
• operating system
• approximate geolocation derived from IP
• referring URLs
• pages viewed
• clicks and interactions
• timestamps and session activity
• crash, performance, and diagnostic information
• cookie identifiers and similar tracking data

C. Information from Third Parties and Integrations

We may receive information from third-party providers, integrations, and subprocessors that support the Platform, including identity verification, financial verification, payments, AI processing, developer tooling, and infrastructure providers. These may include:

• Persona for identity verification and related KYC/KYB workflows
• Plaid for bank account and financial account verification
• Stripe for payments, subscriptions, billing, and related transaction processing
• OpenAI for AI-powered processing and model-based features, including models we may use such as OpenAI GPT-4.2
• Google Gemini for AI-powered processing and model-based features, including models we may use such as Gemini 3
• Anthropic for AI-powered processing and model-based features, including models we may use such as Claude Sonnet 4.6
• GitHub for code repository, engineering, and platform development workflows
• GitLab for code repository, engineering, and platform development workflows

We may also use cloud, hosting, storage, analytics, security, communications, and infrastructure vendors in connection with the operation of the Platform.

3. How We Use Information

We use personal information and other data for legitimate business and operational purposes, including to:

create and manage user accounts;
authenticate users and maintain platform security;
verify identity, investor status, startup information, and eligibility;
onboard founders, startups, investors, and related users;
process diligence, validation, and review workflows;
analyze uploaded documents, records, and supporting materials;
generate structured outputs, summaries, document drafts, risk flags, insights, and related platform results;
provide AI-enabled features, search, classification, extraction, summarization, and workflow assistance;
process payments, subscriptions, billing, and transaction-related events;
enable messaging, collaboration, channel activity, and related communications;
respond to support requests and user inquiries;
detect, investigate, and prevent fraud, abuse, misuse, unauthorized access, and security incidents;
improve the Platform, product performance, reliability, and user experience;
conduct internal research, testing, debugging, monitoring, and analytics;
comply with legal, regulatory, contractual, and compliance obligations;
enforce our Terms, policies, and internal controls.

We do not sell personal information for monetary consideration.

4. AI and Automated Processing

Lunaseed uses AI-enabled systems as part of certain product features and internal workflows. These tools may assist with document processing, classification, summarization, extraction, validation support, diligence workflows, structured reporting, communications support, and other platform functions.

Our AI-related processing may involve third-party AI providers and models, including:

OpenAI, including models such as GPT-4.2
Google Gemini, including models such as Gemini 3
Anthropic, including models such as Claude Sonnet 4.6

Information submitted to the Platform, including documents, prompts, form inputs, and user content, may be processed through these systems where necessary to provide product functionality.

Where third-party AI providers process data on our behalf, such processing is subject to their applicable contractual and technical controls, as well as our internal vendor management and security practices.

You should not submit information to the Platform unless you are authorized to do so and have the necessary rights and permissions to provide that information for processing.

5. Cookies and Similar Technologies

We use cookies, local storage, pixels, session tokens, and similar technologies to:

keep users signed in;
maintain sessions and authentication;
remember preferences and settings;
understand product usage and traffic patterns;
improve functionality and performance;
support security and fraud prevention.

You may be able to manage cookie settings through your browser or device controls. Disabling some cookies may affect the availability or functionality of parts of the Platform.

6. How We Share Information

We may disclose information in the following circumstances:

A. Service Providers and Sub processors

• We may share information with vendors and service providers that perform services on our behalf, including hosting, storage, infrastructure, identity verification, payment processing, financial account verification, AI processing, security monitoring, communications, analytics, and engineering support.

B. Integrated Services

• Where you use or connect a service that relies on an integration, we may share relevant data with that provider as needed to perform the requested function.

C. Within the Platform

• Depending on the product workflow, information may be shared among authorized founders, startup team members, investors, reviewers, administrators, and other approved users as part of diligence, collaboration, messaging, access-control, or transaction-related workflows.

D. Legal and Compliance Requirements

• We may disclose information where required to do so by law, subpoena, court order, regulatory request, governmental inquiry, or other legal process, or where we believe disclosure is reasonably necessary to protect rights, safety, or the integrity of the Platform.

E. Corporate Transactions

• We may disclose information in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar corporate event, subject to customary confidentiality and legal protections.

F. With Your Direction or Consent

• We may share information where you request, authorize, or direct us to do so.

7. Categories of Third-Party Providers We May Use

For clarity and transparency, the Platform may rely on third-party vendors and integrations in categories such as:

identity verification providers
payment processors
financial account verification providers
cloud hosting and storage providers
AI and model inference providers
engineering, repository, and deployment tooling providers
security and fraud monitoring vendors
email and communications infrastructure providers
logging, analytics, and observability vendors
customer support and operational tooling providers

Examples of providers currently used or supported may include Persona, Plaid, Stripe, OpenAI, Google Gemini, Anthropic Claude, GitHub, and GitLab.

We may update or replace providers from time to time as our Platform evolves.

8. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

provide the Platform and maintain accounts;
complete diligence, validation, transaction, and support workflows;
comply with legal, tax, accounting, audit, and recordkeeping obligations;
resolve disputes;
enforce agreements;
protect against fraud, misuse, and security risks.

Retention periods may vary based on the type of information, the nature of the service, legal obligations, dispute status, and operational need.

When we no longer need information, we may delete it, anonymize it, or de-identify it, unless retention is required or permitted by law.

9. Data Security

We use administrative, technical, and organizational safeguards designed to protect information from unauthorized access, loss, misuse, alteration, or disclosure. These measures may include:

encrypted transmission using TLS or equivalent protections;
access controls and role-based restrictions;
logging and monitoring;
authentication and session controls;
vendor due diligence;
internal need-to-know limitations;
secure development and operational practices.

No system is completely secure, and we cannot guarantee absolute security.

Users are responsible for maintaining the confidentiality of their credentials and for notifying us promptly of any suspected unauthorized use of their account.

10. International Data Transfers

Lunaseed operates primarily in the United States, and information may be processed, stored, or accessed in the United States or other jurisdictions where our service providers operate.

If you access the Platform from outside the United States, you understand that your information may be transferred to, processed in, and stored in jurisdictions that may have different data protection laws than your home jurisdiction.

11. Your Privacy Rights

Depending on your location and applicable law, you may have rights regarding your personal information, including the right to:

request access to certain personal information we hold about you;
request correction of inaccurate information;
request deletion of certain personal information;
request information about how your personal information is collected, used, or disclosed;
appeal or complain where permitted by applicable law.

We may need to verify your identity before acting on a request. We may also deny or limit requests where permitted by law.

To submit a privacy request, contact: info@lunaseed.io

12. California Privacy Notice

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended, including the right to:

know what categories of personal information we collect;
know the sources of personal information;
know the business purposes for collection, use, and disclosure;
request deletion of certain personal information;
request correction of inaccurate personal information;
be free from discrimination for exercising your privacy rights.

Lunaseed does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are commonly understood under California privacy law, unless and until stated otherwise in an updated policy.

California residents may exercise privacy rights by contacting: info@lunaseed.io

13. Do Not Track

Some browsers offer a "Do Not Track" setting. Because there is no universally accepted standard for responding to such signals, the Platform may not respond to Do Not Track requests in all cases.

14. Children's Privacy

The Platform is intended for business and professional use and is not directed to children under 18. We do not knowingly collect personal information from children under 18.

If you believe a child has provided personal information to us, contact us at info@lunaseed.io, and we will take appropriate steps to review and address the matter.

15. Third-Party Sites and Services

The Platform may contain links to third-party sites, services, repositories, documentation pages, or external tools. We are not responsible for the privacy, security, or content practices of third parties that we do not control.

Your use of third-party services is governed by their own terms and privacy policies.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, services, technologies, legal requirements, or privacy practices.

When we make changes, we will update the Effective Date above. Where required, we may also provide notice through the Platform, by email, or by other appropriate means.

Your continued use of the Platform after an updated Privacy Policy becomes effective indicates your acknowledgment of the revised policy.

17. Contact Us

If you have questions, concerns, or privacy requests, contact us at:

Lunaseed Inc.

Email: info@lunaseed.io

Website: https://www.lunaseed.io

Registered Office: 6221 Cypress Ave, El Cerrito, California, United States

18. Platform and Regulatory Disclaimer

Lunaseed is a technology platform. Unless explicitly stated otherwise in a separate written agreement, Lunaseed is not acting as a law firm, broker-dealer, investment adviser, bank, or fiduciary.

Any diligence outputs, summaries, flags, validations, automated analyses, or AI-assisted results provided through the Platform are provided as technology-enabled platform outputs and do not by themselves constitute legal advice, investment advice, or regulatory advice.

Users are responsible for independently reviewing and evaluating information, and for obtaining their own legal, financial, tax, compliance, or investment advice where appropriate.

Legal Disclaimer

Lunaseed, an American technology company, is a venture execution platform that turns company diligence into a structured, auditable, decision-ready workspace for both founders and venture firms. The company is not a licensed broker-dealer, investment advisor, or law firm. All data handled by Lunaseed follows U.S. federal and state data-protection requirements and the policies of our third-party verification providers.