Effective: May 16, 2026

Culture Capability Inc. (“Culture Capability,” “we,” “our,” or “us”) respects privacy and is committed to protecting personal information. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use Sirano and any associated software applications, websites, consulting services, professional services, and related offerings (collectively, the “Services”).

Culture Capability Inc. is a Delaware corporation with a mailing address at 1050 W Alameda Ave. Unit 546, Burbank, CA 91506. You can contact us at info@currencygroup.co.

This Privacy Policy applies to individuals who use the Services and to representatives, administrators, and authorized users of companies or other entities that use or purchase the Services. It does not apply to information processed by third-party services that have their own privacy policies.

We do not currently target or offer Services to individuals located in the European Economic Area, the United Kingdom, or Switzerland, and this policy does not include a separate GDPR privacy notice. If that changes, we will update this policy and our practices as appropriate.

“Personal Information” means information that identifies, relates to, describes, can reasonably be associated with, or could reasonably be linked to an individual or household. We collect Personal Information in the following ways.

Information you provide to us. We collect information you choose to provide, including account information, name, email address, phone number, company or organization name, job title, billing information, communications, support requests, feedback, survey responses, event information, and other information you submit through the Services.

Content and consulting materials. We collect prompts, files, messages, text, images, documents, assessment information, business information, workshop materials, notes, instructions, and other content you submit or make available through Sirano or our consulting services (“Content”). Content may include Personal Information about you, your employees, contractors, customers, users, or other individuals, depending on what you provide.

Information from your use of the Services. We automatically collect log data, device information, browser type, operating system, IP address, identifiers, pages or features used, dates and times of access, usage activity, error reports, diagnostic data, cookie data, and approximate location inferred from IP address.

Information from business customers and administrators. If your account is provided by a company or organization, we may receive information from that organization, such as your name, email address, role, permissions, team, workspace membership, usage entitlements, and account status.

Information from third parties and integrations. We may receive information from payment processors, identity and security providers, analytics providers, marketing providers, customer relationship tools, professional advisors, publicly available sources, and third-party services that you or your organization connect to the Services.

Sensitive Personal Information. We do not intentionally request sensitive Personal Information unless it is necessary for a specific Service, you choose to provide it, or it is included in Content you submit. Sensitive information may include account log-in credentials, contents of messages or files, precise geolocation if a feature requires and you enable it, or other information treated as sensitive under applicable law. We do not use sensitive Personal Information to infer characteristics about you unless permitted by law and necessary for the Services you requested.

We use Personal Information for the following purposes:

• Provide, operate, maintain, and improve the Services, including Sirano software features, websites, support, consulting services, and deliverables.
• Create and manage accounts, authenticate users, administer workspaces, and provide access to authorized users.
• Process payments, subscriptions, invoices, taxes, refunds, and related business records.
• Respond to questions, requests, support tickets, feedback, and other communications.
• Configure, personalize, analyze, and improve the Services and user experience.
• Prepare, deliver, and improve consulting services, assessments, workshops, reports, recommendations, and related deliverables.
• Protect the security, integrity, availability, and safety of the Services; detect, prevent, and investigate fraud, abuse, security incidents, policy violations, and unlawful activity.
• Send administrative messages, service updates, security alerts, changes to terms or policies, and other transactional notices.
• Send marketing communications about our products, services, events, or content, where permitted by law and subject to your opt-out choices.
• Comply with legal obligations; respond to lawful requests; enforce agreements; and protect the rights, privacy, safety, or property of Culture Capability, our users, customers, and others.
• Create aggregated, de-identified, or anonymized information that does not identify you and use it for analytics, benchmarking, research, service improvement, and business purposes.

Content and model improvement. We use Content to provide, maintain, troubleshoot, secure, and improve the Services and to perform the consulting services you request. We may use aggregated or de-identified information for analytics and service improvement. For paid business customers and consulting engagements, we do not use confidential business Content to train generally available third-party foundation models unless you direct us to do so, enable a feature that does so, or agree otherwise in an Order or other written agreement.

We disclose Personal Information as described below. We do not disclose more information than we reasonably believe is necessary for the relevant purpose.

• Service providers and vendors. We disclose information to vendors that help us operate the Services, such as cloud hosting, infrastructure, analytics, security, customer support, email, collaboration, payment processing, billing, and professional services providers.
• Business customers and administrators. If your account is associated with a company or organization, administrators and authorized personnel may access and manage your account, workspace, usage information, permissions, and Content according to that organization’s arrangements with us and its own policies.
• Third-party services and integrations. We disclose information to third-party services when you or your organization instructs us to connect, integrate, export, share, or otherwise make information available to them.
• Professional advisors. We may disclose information to lawyers, auditors, accountants, insurers, bankers, and other advisors where necessary for legitimate business purposes.
• Legal, safety, and enforcement. We may disclose information to courts, regulators, law enforcement, government authorities, or other third parties when we believe disclosure is required or appropriate to comply with law, protect rights or safety, prevent fraud or abuse, enforce agreements, or respond to lawful process.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, Personal Information may be disclosed or transferred as part of that transaction.
• With your direction or consent. We disclose information when you direct us to do so or consent to the disclosure.

We do not sell Personal Information for money. We also do not share Personal Information for cross-context behavioral advertising as that term is used in certain U.S. privacy laws. If our practices change, we will update this policy and provide any required choices.

SMS consent is not shared with third parties or affiliates for marketing purposes.

When a company, organization, or other entity purchases or administers the Services, that entity may determine how its authorized users access and use the Services. The organization may control accounts, manage permissions, access usage data, review Content, and request exports or deletion according to its agreement with us and its own policies.

If you use the Services through an organization, direct privacy and access questions first to that organization. We may refer requests relating to organization-controlled accounts or Content to the organization or require the organization’s authorization before acting on the request.

You and your organization are responsible for providing any notices and obtaining any consents needed before submitting Personal Information about employees, contractors, customers, or other individuals to the Services.

We and our service providers may use cookies, pixels, local storage, software development kits, and similar technologies to operate the Services, remember preferences, authenticate users, improve performance, analyze usage, secure the Services, and understand how our websites and applications are used.

Your browser or device may allow you to block or delete cookies. Some features may not work properly without necessary cookies. At this time, we do not respond to browser “Do Not Track” signals because there is no generally accepted standard for those signals. Where required by law and technically feasible, we will treat legally recognized opt-out preference signals, such as Global Privacy Control, as requests to opt out of sale or sharing for the browser or device that sends the signal.

You may have choices about your Personal Information, depending on the Services you use and applicable law. These may include:

• Account settings. You may be able to access, update, export, or delete certain account information through your account or by contacting us.
• Marketing communications. You may opt out of marketing emails by using the unsubscribe link in the email or by contacting us. You may still receive transactional or service-related messages.
• Cookies. You can manage cookies through browser or device settings and, where available, through cookie controls we provide.
• Organization-controlled accounts. If your account is managed by an organization, your choices may be subject to that organization’s policies and instructions.

Depending on where you live and subject to applicable exceptions, you may have the right to request that we:

• provide access to or a copy of Personal Information we maintain about you;
• explain the categories of Personal Information we collect, the sources of that information, the purposes for collection, and the categories of third parties to whom we disclose it;
• correct inaccurate Personal Information;
• delete Personal Information;
• provide a portable copy of certain Personal Information;
• opt out of sale or sharing of Personal Information, if applicable;
• limit the use or disclosure of sensitive Personal Information, if applicable; and
• not discriminate or retaliate against you for exercising privacy rights.

To exercise rights, contact us at info@currencygroup.co or at the mailing address below. We may need to verify your identity or authority before fulfilling a request. If you submit a request through an authorized agent, we may require proof of authorization and may ask you to verify your identity directly. If applicable law gives you a right to appeal our decision, you may appeal by replying to our decision email or contacting us at info@currencygroup.co.

We do not knowingly sell or share Personal Information of individuals under 16. We also do not process sensitive Personal Information for the purpose of inferring characteristics about you.

The following chart summarizes categories of Personal Information we may collect, sources, purposes, and disclosure categories. Not every category applies to every user or Service.

CategoryExamples and sourcesPurposes and disclosure categoriesIdentifiers and account informationName, email, phone, mailing address, username, account credentials, company, title, workspace membership. Sources: you, your organization, integrations.Account creation, authentication, support, administration, security, communications. Disclosed to service providers, organization administrators, professional advisors, legal authorities, and transaction parties.Commercial and billing informationSubscriptions, invoices, payment tokens, transaction history, tax and billing details. Sources: you and payment processors.Payment processing, accounting, taxes, fraud prevention, customer support. Disclosed to payment processors, billing vendors, advisors, legal authorities, and transaction parties.Content and consulting materialsPrompts, files, messages, reports, assessment materials, notes, recordings, business information, deliverables. Sources: you, authorized users, your organization, connected services.Provide Sirano and consulting services, create deliverables, troubleshoot, secure, and improve Services. Disclosed to service providers, integrations you direct, organization administrators, advisors, legal authorities, and transaction parties.Internet, device, and usage informationIP address, browser, device identifiers, operating system, app activity, logs, diagnostics, approximate location from IP, cookie data. Sources: automatic collection.Operate, secure, debug, analyze, and improve Services. Disclosed to hosting, analytics, security, support, and infrastructure providers, and legal authorities when required.Communications and support informationEmails, support tickets, chat messages, feedback, survey responses, event registration information. Sources: you and service providers.Respond to requests, provide support, improve Services, send notices and permitted marketing. Disclosed to support, email, CRM, analytics, and professional service providers.Professional or organizational informationCompany, role, title, team, department, business contact details, work-related assessment information. Sources: you, your organization, and connected services.Administer business accounts, perform consulting services, prepare deliverables, personalize organizational insights. Disclosed to service providers, organization administrators, advisors, and legal authorities.Inferences and preferencesPreferences, settings, usage patterns, feature interests, recommendations, derived analytics. Sources: your use of the Services and information you provide.Personalize and improve Services, understand usage, develop insights. Disclosed to service providers and organization administrators where applicable.Sensitive Personal InformationAccount log-in information, contents of messages or files, precise geolocation if enabled, or sensitive information included in Content. Sources: you, your organization, or automatic collection when enabled.Provide, secure, and support Services; comply with law. Not used to infer characteristics except where permitted and necessary. Disclosed only as needed to service providers, organization administrators, legal authorities, or at your direction.

Sale or sharing. We do not sell Personal Information for money and do not share Personal Information for cross-context behavioral advertising. If we begin engaging in activities that are considered a “sale” or “sharing” under applicable privacy law, we will update this policy and provide required opt-out mechanisms.

Data minimization. We seek to collect, use, retain, and disclose Personal Information only as reasonably necessary and proportionate for the purposes described in this policy or as otherwise disclosed to you.

We retain Personal Information for as long as reasonably necessary to provide the Services, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, enforce agreements, maintain business records, prevent fraud or abuse, and protect the security and integrity of the Services.

Retention periods depend on the type of information, the Services used, the nature of the relationship, legal requirements, security needs, whether information is contained in backups, and your or your organization’s settings or instructions. When Personal Information is no longer reasonably necessary, we will delete it, de-identify it, aggregate it, or retain it only as permitted or required by law.

We use commercially reasonable technical, administrative, and organizational measures designed to protect Personal Information against unauthorized access, disclosure, alteration, and destruction. These measures may include access controls, authentication, encryption in transit where appropriate, monitoring, vendor controls, and operational safeguards.

No Internet, email, or electronic storage system is completely secure. You are responsible for safeguarding your account credentials, using appropriate access controls, and limiting the Personal Information you submit to what is appropriate for your use of the Services.

The Services are not directed to children under 13, and we do not knowingly collect Personal Information from children under 13. If you believe a child under 13 has provided Personal Information to us, please contact us at info@currencygroup.co so we can take appropriate steps. Users under 18 must use the Services only with permission from a parent or legal guardian.

We are based in the United States, and the Services are operated from the United States. Personal Information may be processed and stored in the United States and in other locations where our service providers operate.

We do not currently target or offer Services to individuals located in the European Economic Area, the United Kingdom, or Switzerland. If you are located outside the United States and use the Services, you understand that your information may be transferred to and processed in the United States, where privacy laws may differ from those in your location.

We may update this Privacy Policy from time to time. When we do, we will update the effective date and publish the revised version. If changes materially affect your rights or our privacy practices, we will provide additional notice where required by law.

Questions, requests, or concerns about this Privacy Policy or our privacy practices may be sent to:

Culture Capability Inc. 1050 W Alameda Ave. Unit 546, Burbank, CA 91506 Email: info@currencygroup.co