GALAD AI-Powered Social Media Management PRIVACY POLICY Last Updated: January 2026 | Effective: January 2026 Galad (“Company,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use the Galad platform, website, mobile applications, and all related services (collectively, the “Service”). By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, you must discontinue use of the Service and may request deletion of your data at any time by contacting us at admin@galad.ai

. Note: Galad is currently operating as an unincorporated business under the trade name “Galad.” The data controller information and governing law will be updated upon formal incorporation. Users will be notified of any material changes. 1. Information We Collect 1.1 Information You Provide When you register for or use the Service, you may provide us with the following information: Full name and email address Business name, description, and website URL (used for brand learning and content generation) Social media account credentials and permissions (via OAuth, for publishing purposes only) Payment and billing details (processed exclusively by Stripe — Galad does not store card numbers) Any other information you voluntarily submit through forms, support requests, or onboarding flows 1.2 Automatically Collected Data When you use the Service, we automatically collect certain technical and usage data, including: Device information (type, operating system, browser) IP address and approximate geographic location Session data, log files, and usage analytics Performance and diagnostic data Referral source and navigation behavior within the platform 1.3 Content and Brand Data As part of the Service, we collect and process: Posts, images, brand assets, and other content you upload or generate AI-generated content created on your behalf Social media scheduling and publishing activity Extracted brand data derived from your website URL (colors, logo, description, tone) 1.4 Tracking Technologies We use cookies, pixel tags, and similar technologies to operate and improve the Service. Specifically: Essential cookies: Required for account authentication and platform functionality. Analytics cookies: Help us understand usage patterns and improve performance (e.g., Google Analytics). Advertising pixels: We use the Meta Pixel (Facebook) on our website to measure the effectiveness of our marketing campaigns. This pixel collects data about your visit in accordance with Meta’s Data Policy. You may disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service. A cookie consent mechanism is presented at your first visit. 2. How We Use Your Information We use the information we collect for the following purposes: To provide, operate, and maintain the Service To generate AI-powered social media content based on your brand inputs To schedule and publish content to your connected social media accounts To process payments and manage your subscription To communicate with you about your account, updates, and support To monitor platform performance, diagnose issues, and ensure security To comply with applicable legal obligations To send you marketing communications (only with your consent; you may opt out at any time) We do not use your information for any purpose beyond what is described in this Privacy Policy without your explicit consent. 3. How AI Processes Your Data Galad uses artificial intelligence to generate social media content on your behalf. Your website URL and brand assets are processed by our AI systems to create captions, visual prompts, calendar content, and templates. We make the following firm commitments regarding AI and your data: Galad does NOT use your User Content, business data, or brand assets to train, fine-tune, or improve any AI or machine learning model, whether proprietary or third-party. Your data is used exclusively to generate content on your behalf and to maintain the functionality of the Service. AI-generated content may occasionally be inaccurate or not fully representative of your brand. You are responsible for reviewing content before it is published. Third-party AI providers (such as Google or OpenAI) are used as sub-processors for inference only. These providers are contractually prohibited from using your data for their own training purposes under our agreements with them. 4. How We Share Your Information Galad does not sell your personal data to third parties. We may share your data only in the following limited circumstances: 4.1 Service Providers (Sub-Processors) We share data with trusted third-party service providers who process it on our behalf to operate the Service: Stripe — Payment processing and billing Amazon Web Services (AWS) — Cloud hosting and infrastructure (data may be processed in the United States) MongoDB Atlas — Database services Google (Gemini) / OpenAI — AI inference for content generation (inference only; no training) Meta Platforms, Inc. — Facebook and Instagram publishing integrations Analytics providers — Platform performance and usage analysis All sub-processors are required to handle your data securely and only for the purposes we specify. 4.2 Social Media Platforms When you connect your social accounts, we share content and credentials with those platforms (e.g., Facebook, Instagram) as necessary to publish on your behalf, in accordance with the respective platform’s terms and privacy policies. 4.3 Legal Requirements We may disclose your information if required to do so by law, court order, or governmental authority, or when we believe disclosure is necessary to protect the rights, safety, or property of Galad, its users, or the public. 4.4 Business Transfers In the event of a merger, acquisition, or sale of all or part of our assets, your information may be transferred to the acquiring entity. We will notify you of any such change and your continued use of the Service constitutes acceptance. 5. International Data Transfers Galad operates in Mexico and the United States. Your data may be transferred to and processed in countries other than your country of residence, including the United States, where our cloud infrastructure (AWS) and AI providers are located. We take appropriate safeguards to ensure that your personal data is protected in accordance with this Privacy Policy and applicable law, including contractual protections with our sub-processors. 6. Data Retention We retain your personal data for as long as your account is active and as necessary to provide the Service. Specific retention periods: Account data: Retained for the duration of your account plus 30 days after termination or cancellation. OAuth tokens and social media credentials: Deleted within 30 days of account termination or disconnection of the relevant social account. Billing records: Retained for up to 7 years as required by applicable tax and accounting laws. AI-generated content and brand assets: Deleted within 30 days of account closure, unless you request earlier deletion. Backup copies: May be retained for up to 60 days in encrypted backup systems before permanent deletion. You may request deletion of your personal data at any time by contacting admin@galad.ai

. We will process deletion requests within 30 days, except where retention is required by law. 7. Security We implement industry-standard technical and organizational security measures to protect your data, including: Encrypted connections (HTTPS/TLS) for all data in transit Encryption at rest for stored data and credentials OAuth-based authorization flows (we do not store your social media passwords) Role-based access controls limiting internal access to your data Regular security monitoring and logging However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights or freedoms, we will notify you as required by applicable law. 8. Your Rights Depending on your jurisdiction, you may have the following rights regarding your personal data: Access: Request a copy of the personal data we hold about you. Correction: Request correction of inaccurate or incomplete data. Deletion: Request deletion of your personal data (subject to legal retention requirements). Portability: Request a copy of your data in a structured, machine-readable format. Objection: Object to certain types of processing, including direct marketing. Restriction: Request that we restrict processing of your data in certain circumstances. 8.1 Mexican Users — LFPDPPP (ARCO Rights) Users in Mexico are protected under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). You have the right to: Access (Acceso): Know what personal data we hold about you and how it is used. Rectification (Rectificación): Correct inaccurate or incomplete data. Cancellation (Cancelación): Request deletion of your data from our records. Opposition (Oposición): Object to the use of your data for specific purposes. To exercise your ARCO rights, contact us at admin@galad.ai

. We will respond within 20 business days as required by law. The data controller responsible for your data is Galad, operating under the trade name “Galad” in Mexico and the United States. 8.2 California Users — CCPA If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including: The right to know what personal information is collected, used, shared, or sold. The right to delete personal information we have collected from you. The right to opt out of the sale of personal information (note: Galad does not sell personal information). The right to non-discrimination for exercising your CCPA rights. To exercise your CCPA rights, contact us at admin@galad.ai

with the subject line “CCPA Rights Request.” 8.3 How to Submit a Request To exercise any of the rights described above, contact us at: Email: admin@galad.ai

Subject line: “Data Rights Request” We will respond to all requests within 30 days (or within the timeframe required by your applicable jurisdiction). We may need to verify your identity before processing your request. 9. Children’s Privacy Galad is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected data from a minor, please contact us at admin@galad.ai

and we will delete the information promptly. 10. Third-Party Links and Services The Service may contain links to third-party websites or integrate with third-party platforms (such as Facebook and Instagram). This Privacy Policy applies only to Galad’s own services. We are not responsible for the privacy practices of third-party websites or platforms, and we encourage you to review their respective privacy policies. 11. Changes to This Privacy Policy We may update this Privacy Policy from time to time. When we make material changes: We will post the updated Privacy Policy at galad.ai/privacy-policy with a new “Last Updated” date. We will notify registered users via email at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Policy. If you do not agree with any updated Privacy Policy, you must stop using the Service and may request deletion of your account before the effective date. 12. Contact Information If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Galad Email: admin@galad.ai

Website: galad.ai Trade name operating in Mexico and the United States By using Galad, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. Galad — Privacy Policy — January 2026