PRIVACY POLICY

Alt+Shift+X Platform

Effective Date: June 14, 2026 | Version: 2.0

Operated by: Trust AR LLC, a West Virginia limited liability company, doing business as Alt+Shift+X 1405 Earl L. Core Rd., Morgantown, WV 26501, United States Email: info@altshiftx.tech

This Privacy Policy explains how Trust AR LLC d/b/a Alt+Shift+X ("we," "us," "our," or the "Platform") collects, uses, stores, shares, and protects your personal information when you visit our website, create an account, purchase or publish Components, or otherwise interact with the Platform. By using the Platform, you agree to the practices described in this Policy. If you do not agree, please do not use the Platform.

SECTION 1 — WHO WE ARE

Alt+Shift+X is an AI component marketplace and subscription platform that connects Buyers (users who install AI components) and Builders (developers who publish AI components). The Platform is owned and operated by Trust AR LLC, a West Virginia limited liability company.

Contact: Trust AR LLC d/b/a Alt+Shift+X 1405 Earl L. Core Rd. Morgantown, WV 26501 United States Email: info@altshiftx.tech (For privacy-specific inquiries, reference "Privacy Request" in the subject line)

SECTION 2 — INFORMATION WE COLLECT

We collect information in three ways: information you provide directly, information collected automatically, and information from third parties.

2.1 Information You Provide Directly

Account Registration Data When you create an account, we collect:

First and last name
Email address
Company name and size (optional)
Job title and industry (optional)
Country, state/province (optional)
Phone number (optional)
How you heard about us

Profile & Intake Data

Use case description
Professional background information provided during onboarding
Builder profile information: bio, tagline, specializations, website, LinkedIn, Twitter/X, Facebook URLs

Payment & Billing Data We do not store full payment card numbers on our servers. Payment data is handled directly by our payment processors (Stripe and PayPal). We do store:

Stripe customer ID
Stripe subscription ID
PayPal subscription ID (where applicable)
Billing plan and status
Transaction records for accounting and compliance purposes

Builder Payout Data

Stripe Connect account ID and status
PayPal payout email address
Insurance certificate information (for Safe Harbor tier Builders)
Policy tier selection

Component Submission Data

Component name, description, features, schema, pricing
Endpoint URLs
Book metadata (for Knowledge Book Tiles)

Communications

Support requests and correspondence
Feedback and review submissions
Social post content created through the Platform's Social Studio

2.2 Information Collected Automatically

When you access the Platform, we automatically collect:

Usage Data

Pages visited and features used
API calls made (volume, timing, endpoints accessed)
Component installs and subscription activity
Search queries within the Platform
Session duration and frequency

Device & Technical Data

IP address
Browser type and version
Operating system
Device type
Referring URL
Time zone

Security & Fraud Prevention Data

Request headers and fingerprints (for security incident detection)
Geographic location derived from IP address (city, country, region)
Honeypot interaction data
Rate limit and access pattern data

2.3 Information from Third Parties

Payment Processors Stripe and PayPal may share transaction confirmation data, payment status, and fraud signals with us to process and reconcile payments.

Authentication Providers If you sign in via a third-party authentication service (e.g., Google), we receive your name and email address from that provider as permitted by your settings there.

Referral Partners If you arrive via a referral or affiliate link, we record the referral source and may receive basic attribution data from our affiliate tracking system.

SECTION 3 — HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

3.1 To Operate the Platform

Create and manage your account
Process purchases, subscriptions, and payouts
Deliver Component access and API functionality
Manage billing, invoicing, and payment reconciliation
Send transactional notifications (purchase confirmations, subscription renewals, payout notifications)

3.2 To Personalize Your Experience

Tailor marketplace recommendations and featured content
Pre-fill forms and dashboards with your profile data
Remember your preferences and settings

3.3 To Communicate With You

Send product updates, new Component announcements, and platform news (you may opt out)
Send important account and security notifications (these cannot be opted out of)
Respond to support requests and inquiries
Send onboarding guidance and platform tips

3.4 To Ensure Platform Safety & Security

Detect, investigate, and respond to security incidents, fraud, and abuse
Monitor for sanctions compliance per our Export Controls & Sanctions Policy
Enforce our Terms of Service and Acceptable Use policies
Operate our security monitoring systems (the Sentinel)
Log audit trails for administrative and compliance purposes

3.5 To Improve the Platform

Analyze usage patterns and feature performance
Identify bugs, errors, and performance issues
Conduct internal research and product development
Generate aggregated, anonymized analytics

3.6 To Support Builders

Calculate and distribute revenue share and escrow payments
Track referral activity and earnings
Provide Builder analytics (installs, revenue, ratings)
Process Kit Pairing revenue splits

3.7 Legal & Compliance

Comply with applicable laws and regulations
Respond to lawful requests from government authorities
Enforce sanctions and export control obligations
Maintain records required for tax and financial reporting
Defend against legal claims

3.8 Marketing (with your consent where required)

Send promotional emails about new features, Components, or platform offers
Run affiliate and referral attribution tracking
Analyze campaign performance

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

| Processing Activity | Legal Basis | |---|---| | Account creation and management | Contract (Art. 6(1)(b) GDPR) | | Processing payments and subscriptions | Contract (Art. 6(1)(b) GDPR) | | Builder payout processing | Contract (Art. 6(1)(b) GDPR) | | Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f) GDPR) | | Sanctions and export controls compliance | Legal obligation (Art. 6(1)(c) GDPR) | | Tax and financial record keeping | Legal obligation (Art. 6(1)(c) GDPR) | | Platform improvement and analytics | Legitimate interests (Art. 6(1)(f) GDPR) | | Marketing communications | Consent (Art. 6(1)(a) GDPR) or Legitimate interests | | Responding to legal requests | Legal obligation (Art. 6(1)(c) GDPR) |

We do not sell your personal data. We share your information only in the following circumstances:

5.1 Service Providers

| Provider | Purpose | Data Shared | |---|---|---| | Stripe | Payment processing, subscriptions, Connect payouts | Payment method data, billing info, transaction records | | PayPal | Alternative payment processing and payouts | Payment info, payout email, transaction records | | Base44 | Platform infrastructure and hosting | All Platform data (hosting provider) | | Email delivery provider | Transactional and marketing emails | Email address, name, notification preferences |

5.2 Builders (Limited)

When you install a Component, the Builder of that Component may receive confirmation that an install occurred and aggregate usage metrics. Builders do not receive your name, email address, payment information, or any personal data beyond what is strictly necessary to operate their Component.

5.3 Legal Requirements

We may disclose your information if required to do so by law, court order, or lawful government request, or if we believe in good faith that disclosure is necessary to comply with applicable laws, protect our rights or safety, enforce our Terms of Service, or report suspected sanctions violations to relevant authorities.

5.4 Business Transfers

If Trust AR LLC is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.

SECTION 6 — COOKIES & TRACKING TECHNOLOGIES

We use cookies and similar technologies as described in our Cookie Policy (/legal/cookies). Non-essential cookies require your consent under GDPR/PECR.

SECTION 7 — DATA RETENTION

We retain your personal data for as long as your account is active and for a reasonable period thereafter to fulfill legal obligations, resolve disputes, and enforce agreements. Transaction records are retained for a minimum of 7 years for tax and accounting compliance.

SECTION 8 — DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data including TLS encryption in transit, encryption at rest for sensitive fields, role-based access controls, multi-factor authentication for administrative access, and automated security monitoring via the Sentinel system.

— Continued in Part 2 (Sections 9–15) — Key: privacy_policy_part2

PRIVACY POLICY — ALT+SHIFT+X

Part 2 of 2 (Sections 9–15)

Effective Date: June 14, 2026 | Version: 2.0 Continued from Part 1 (Sections 1–8) Key: privacy_policy_part1

Operated by: Trust AR LLC d/b/a Alt+Shift+X | 1405 Earl L. Core Rd., Morgantown, WV 26501

SECTION 9 — YOUR PRIVACY RIGHTS

Depending on where you are located, you may have the following rights regarding your personal data:

9.1 Rights for All Users

Right to Access — Request a copy of the personal data we hold about you. We respond within 30 days.

Right to Correction — Request correction of inaccurate or incomplete data. Most profile data can be corrected directly in account settings.

Right to Deletion — Request deletion or anonymization of your personal data, subject to: (a) data we must retain by law; (b) data needed to resolve pending disputes; (c) data for legitimate security purposes.

Right to Opt Out of Marketing — Opt out of marketing communications at any time via any marketing email's unsubscribe link or by contacting us. Transactional and security notifications cannot be opted out of.

Right to Withdraw Consent — Where we process data based on your consent, you may withdraw at any time. Withdrawal does not affect prior processing.

9.2 Additional Rights for EEA, UK, and Swiss Users (GDPR / UK GDPR)

Right to Restrict Processing — Request restriction of processing in certain circumstances.

Right to Data Portability — Request your personal data in a structured, machine-readable format where technically feasible and where processing is based on contract or consent.

Right to Object — Object to processing based on legitimate interests, including profiling for direct marketing.

Right to Lodge a Complaint — Lodge a complaint with your local supervisory authority. In the UK: Information Commissioner's Office (ICO) — ico.org.uk.

9.3 Additional Rights for California Residents (CCPA / CPRA)

Right to Know — Request disclosure of: categories and specific pieces of personal information collected; categories of sources; business/commercial purpose for collection; categories of third parties we share with.

Right to Delete — Request deletion of personal information, subject to exceptions.

Right to Correct — Request correction of inaccurate personal information.

Right to Opt Out of Sale or Sharing — We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Right to Limit Use of Sensitive Personal Information — We use sensitive personal information only as necessary to provide the Platform and as permitted by law.

Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.

How to Exercise California Rights: Submit to info@altshiftx.tech — subject: "California Privacy Request." We respond within 45 days (with possible 45-day extension).

9.4 How to Submit Privacy Requests

Email: info@altshiftx.tech Subject: "Privacy Request — [Type of Request]"

We acknowledge within 5 business days and respond fully within 30 days (or the applicable statutory deadline for your jurisdiction). We may verify your identity before processing your request.

SECTION 10 — INTERNATIONAL DATA TRANSFERS

10.1 Where We Process Data

Trust AR LLC d/b/a Alt+Shift+X is based in West Virginia, United States. Your personal data is processed and stored on servers in the United States.

10.2 Transfers from the EEA, UK, or Switzerland

Transfers from the EEA, UK, or Switzerland to the United States are made under:

EU Standard Contractual Clauses (SCCs): European Commission Decision 2021/914/EU
UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs
Adequacy Decisions: Where applicable

SECTION 11 — CHILDREN'S PRIVACY

The Platform is intended for users 18 years of age or older. We do not knowingly collect personal data from children under 13 (or under 16 in the EEA/UK). If you believe we have inadvertently collected such data, contact us immediately at info@altshiftx.tech. See also our Children's Safety Policy at /legal/childrens-safety.

SECTION 12 — THIRD-PARTY LINKS & SERVICES

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. Payment processing is handled by Stripe (stripe.com/privacy) and PayPal (paypal.com/privacy).

SECTION 13 — AI-SPECIFIC DATA PRACTICES

13.1 Component Interactions

Your inputs to Components are processed to generate outputs. We do not use your Component inputs to train external AI models. Component inputs may be logged for security monitoring and operational debugging.

13.2 Platform AI Agents

Platform agents (the UpKeeper, BOB, the Sentinel, the Front Man, and others) may process your account data, transaction records, and security signals as part of their operational function. They do not share your data externally.

13.3 Social Studio

Content drafted in the Social Studio is stored as SocialPost records on the Platform. It is not shared externally without admin authorization.

SECTION 14 — DATA BREACH NOTIFICATION

In the event of a personal data breach likely to risk your rights and freedoms, we will:

Notify relevant supervisory authorities within 72 hours (where required by GDPR/UK GDPR)
Notify affected users without undue delay if the breach poses high risk
Provide information about the nature of the breach, data affected, likely consequences, and measures taken

SECTION 15 — UPDATES & CONTACT

15.1 Updates

We may update this Privacy Policy periodically. Material changes will be communicated via email and Platform notice at least 14 days before they take effect. The "Last Updated" date at the top of this document reflects the most recent revision.

15.2 Contact

Trust AR LLC d/b/a Alt+Shift+X 1405 Earl L. Core Rd. Morgantown, WV 26501 United States Email: info@altshiftx.tech Subject: "Privacy Request — [Type of Request]"

West Virginia governing law applies to this policy. For EU/UK users, nothing in this policy affects your statutory rights under GDPR or UK GDPR.

Privacy Policy — Alt+Shift+X (Part 1 of 2: Sections 1–8)