XPEDITE PRIVACY POLICY

1. Information We Collect

We may collect the following categories of information.

A. Account and Contact Information

When you create or use an Xpedite account, we may collect information such as:

• Your name
• Email address
• Password or authentication information
• Company or organization name
• Job title or role
• Account preferences
• Organization membership information

Authentication may be provided through a third-party authentication service. Kleos does not need to receive or store your authentication provider’s underlying password.

B. Company Profile and Business Information

To provide opportunity matching and related functionality, Xpedite may collect information about you or your organization, including:

• Company descriptions
• Products and services
• Capabilities and areas of expertise
• Industry classifications
• North American Industry Classification System codes
• Product and Service Codes
• Certifications and socioeconomic designations
• Geographic information
• Contracting interests
• Government contracting experience
• Website information
• Opportunity preferences
• Other information you choose to include in a company profile

Some of this information may be publicly available or obtained from government, commercial, or other third-party sources.

C. Information Submitted for Processing

You may submit text, documents, website information, solicitation information, or other content for analysis by the Services.

Xpedite does not operate as a file-storage service and does not provide persistent storage of original uploaded files. Submitted content may be processed to provide requested functionality, including extracting information, creating or improving company profiles, analyzing opportunities, and generating results.

Information derived from submitted content, such as saved profile information, matching results, classifications, summaries, or other user-selected records, may be retained as part of your account or organization workspace.

D. Billing Information

If you purchase a subscription, payment processing is handled by Stripe or another designated payment processor.

Kleos generally does not receive or store complete payment-card numbers. We may receive limited transaction information, such as:

• Customer or subscription identifiers
• Billing status
• Subscription plan
• Payment status
• Renewal and cancellation information
• Limited billing contact information

Stripe’s handling of payment information is governed by Stripe’s own privacy policy and terms.

E. Usage and Technical Information

When you use the Services, we may automatically collect information such as:

• Internet Protocol address
• Browser and device type
• Operating system
• Pages or features accessed
• Dates and times of access
• Referring pages
• Session and interaction information
• Error, diagnostic, and performance data
• General location inferred from an Internet Protocol address
• Security and authentication events

We may use cookies and similar technologies to operate the Services, maintain sessions, remember preferences, understand usage, improve performance, and support analytics.

F. Communications

We may collect information when you:

• Contact Kleos
• Request information
• Submit feedback
• Respond to surveys
• Communicate with customer support
• Subscribe to product or service communications

2. How We Use Information

We may use information to:

• Provide, operate, maintain, and improve Xpedite
• Create and manage accounts and organization workspaces
• Authenticate users and protect account access
• Generate, maintain, or improve company profiles
• Identify and analyze potentially relevant government contracting opportunities
• Calculate and explain opportunity matches
• Generate summaries, classifications, recommendations, and other outputs
• Personalize the Services
• Process subscriptions and manage billing
• Send account, security, transactional, and service-related communications
• Respond to questions and support requests
• Monitor performance and troubleshoot errors
• Detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity
• Enforce our Terms of Service
• Comply with legal obligations and protect legal rights
• Develop new features and services
• Create aggregated or de-identified information that does not reasonably identify an individual or organization

3. Artificial Intelligence Processing

Xpedite uses artificial intelligence, machine learning, semantic analysis, and related technologies to provide certain features.

Information you submit may be processed by Kleos systems or by AI service providers, including OpenAI and locally or privately operated models through Ollama, solely to provide, maintain, secure, or improve requested Xpedite functionality.

Customer data submitted through Xpedite is not used by Kleos to train general-purpose Kleos models. Kleos does not authorize third-party AI providers to use customer data submitted through Xpedite to train their general-purpose foundation models.

AI-generated outputs may be incomplete, inaccurate, or inappropriate for a customer’s particular circumstances. Users should independently review AI-generated information and verify important information using authoritative sources.

4. How We Disclose Information

Kleos does not sell personal information.

We may disclose information in the following circumstances.

A. Service Providers

We may disclose information to vendors that perform services on our behalf, such as:

• Cloud hosting and database services
• Authentication services
• Email delivery
• Artificial intelligence processing
• Analytics
• Payment processing
• Error monitoring and system diagnostics
• Security and infrastructure support

Current providers may include DigitalOcean, Firebase, SendGrid, OpenAI, Google Analytics, Grafana, and Stripe. Providers may change as Xpedite evolves.

These providers process information as necessary to provide their respective services to Kleos, subject to applicable agreements, terms, and privacy practices.

B. Organization Workspaces

If your account belongs to an organization workspace, authorized members of that organization may be able to access information associated with the workspace, including:

• Company profiles
• Saved opportunities
• Matching results
• Organization settings
• Shared activity or records
• Member names and email addresses

Organization owners and authorized administrators may manage membership, remove users, delete organization content, or delete the organization.

Your use of an organization workspace may also be subject to your organization’s own policies and instructions.

C. Legal and Safety Reasons

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request
• Protect the rights, property, or safety of Kleos, our users, or others
• Investigate fraud, abuse, security incidents, or unlawful conduct
• Enforce agreements and policies
• Establish, exercise, or defend legal claims

D. Business Transactions

Information may be disclosed or transferred in connection with an actual or proposed merger, financing, acquisition, restructuring, sale of assets, bankruptcy, or similar business transaction.

E. With Your Direction or Permission

We may disclose information when you direct us to do so or otherwise provide permission.

5. Government and Third-Party Information

Xpedite may collect or display information obtained from government websites, procurement systems, publicly available sources, and third-party data providers.

Kleos does not control the privacy, accuracy, availability, or data-handling practices of those sources. Access to third-party websites or services is governed by the policies and terms of those third parties.

6. Sensitive and Regulated Information

Xpedite is not designed to receive or process the following categories of information:

• Classified information
• Controlled Unclassified Information
• Export-controlled technical data
• Protected health information
• Social Security numbers
• Complete payment-card information
• Account passwords
• Sensitive government information not authorized for disclosure
• Information you do not have the legal or contractual authority to provide

You must not submit such information through the Services.

Federal Contract Information may be submitted when reasonably necessary for legitimate government-contracting activities. However, users should minimize the Federal Contract Information they provide and submit only information necessary for the requested use of Xpedite.

You are responsible for determining whether information may lawfully and appropriately be submitted to the Services.

7. Data Retention and Deletion

We retain information for as long as reasonably necessary to:

• Provide and maintain the Services
• Maintain your account or organization workspace
• Complete requested transactions
• Comply with legal obligations
• Resolve disputes
• Enforce agreements
• Establish, exercise, or defend legal claims
• Protect the security and integrity of the Services

Individual users may delete their accounts and company profiles they created through available account functionality.

Organization owners may remove organization members, delete profiles they created, or delete the organization.

Kleos administrators may delete accounts or profiles when necessary to operate, secure, or enforce the Services.

When information is deleted, we will remove it from active systems as soon as reasonably practicable. Limited information may remain where retention is required by law or reasonably necessary for legal claims. Residual copies may also remain temporarily in routine system backups until those backups are overwritten or expire through ordinary processes.

8. Your Choices

Depending on your account and available functionality, you may:

• Review or update account information
• Request a portable export of data associated with your account
• Update company-profile information
• Delete profiles you created
• Delete your account
• Manage organization membership and content if authorized
• Cancel a paid subscription through the designated Stripe billing interface
• Adjust browser settings relating to cookies
• Unsubscribe from optional marketing communications

Signed-in users can submit export and deletion requests from Data & privacy settings. Export download links are private, time-limited, and delivered to the account email address.

You may continue to receive transactional, security, billing, or service-related communications while you maintain an account or subscription.

You may contact Kleos at [email protected] to request assistance with account information or privacy-related questions.

We may need to verify your identity or authority before completing a request.

9. Security

Kleos takes security seriously and uses reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Services and information involved.

These safeguards may include authentication, access controls, encryption where appropriate, monitoring, logging, infrastructure protections, and procedures intended to prevent unauthorized access, use, alteration, or disclosure.

No system, transmission method, or storage environment can be guaranteed to be completely secure. Kleos does not warrant or guarantee that unauthorized access, loss, misuse, or other security incidents will never occur.

You are responsible for:

• Protecting your account credentials
• Using appropriate security controls on your devices
• Restricting account access to authorized individuals
• Promptly notifying Kleos of suspected unauthorized access or security incidents involving your account

10. Analytics and Cookies

We may use Google Analytics and similar technologies to understand how users interact with the Services.

When optional Google Analytics is enabled, we ask for your choice before loading it. You can allow or decline analytics and change that choice through Analytics preferences in the public-page footer. Declining optional analytics does not prevent you from using Xpedite.

Our optional measurement covers public-page visits, plan selections, completed account signups, and successfully submitted contact requests. We exclude account identifiers, email addresses, URL query parameters, invitation tokens, form contents, and workspace content from those event payloads. Google may still collect device, browser, cookie, and network information.

Disabling cookies may affect the functionality of the Services.

11. Children’s Privacy

Xpedite is a business-oriented service and is not directed to children under 13 years of age.

Kleos does not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the Services, contact us so we can review and address the matter.

12. International Use

Xpedite is operated from the United States.

If you access the Services from outside the United States, you understand that information may be processed and maintained in the United States and other jurisdictions where Kleos or its service providers operate.

You are responsible for ensuring that your use of the Services complies with laws applicable to you and your organization.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically.

When we make material changes, we may provide notice through the Services, by email, or through another reasonable method. The updated policy will identify its effective date.

The updated Privacy Policy will apply from the effective date identified in the updated policy.

14. Contact Us

Questions or requests concerning this Privacy Policy may be directed to: