Privacy Policy Version: 2.0 — Effective date: July 15, 2026 This policy replaces all previous versions. Material changes are notified by email, and you may be asked to accept the new version at sign-in.

1. Who we are The Ubby service (ubby.ai) is published and operated by: SUCSEED SAS A French simplified joint-stock company (société par actions simplifiée) Company number (SIREN): 982 685 315 — Paris Trade Register Registered office: 60 rue François Ier, 75008 Paris, France Email: legal@ubby.ai SUCSEED SAS ("Ubby", "we") is the data controller for the personal data described in this policy. Data protection contact. Ubby is not legally required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. A data protection contact is available for any question or request regarding your data: legal@ubby.ai (subject line: "GDPR"). 1.1 Two distinct roles Under the GDPR, Ubby acts in two capacities: Data controller — for the data described in this policy: your account, your conversations with agents, billing, support, and service security. Data processor — for the data that your organization (or the customer organization granting you access to Ubby) entrusts to agents during their execution: documents, emails, and business data processed through your connected tools. That processing is governed by the Data Processing Agreement (DPA) entered into with the customer, available upon request at legal@ubby.ai. For that data, the controller is your organization: please direct data subject requests to it first. This policy covers the processing for which Ubby is the controller.
2. What data, for which purposes, on which legal bases? Purpose Data processed Legal basis (Art. 6 GDPR) Account creation and management Identity (first/last name), business email, password (hashed), organization, workspace role Performance of a contract (Art. 6(1)(b)) Service delivery: agent execution Conversation content and instructions (prompts), files submitted to agents, execution results, agent and workflow configuration Performance of a contract (Art. 6(1)(b)) Connecting your third-party tools (integrations) Encrypted authentication credentials for the services you connect (Drive, Notion, Outlook, Slack, Teams, WhatsApp, etc.) Performance of a contract (Art. 6(1)(b)) Billing and payment Identity, email, billing details, payment history (card numbers are processed exclusively by Stripe and never stored by Ubby) Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) Customer support Support exchanges, account data needed to handle the request Performance of a contract (Art. 6(1)(b)) Security, abuse prevention, logging Pseudonymized AI usage logs (ai_usage_audit), admin audit logs (admin_audit_log), IP addresses, technical identifiers Legitimate interest (Art. 6(1)(f)): securing the service and detecting abuse Technical monitoring (errors and performance) Error events (Sentry) and LLM observability traces (Langfuse), with pseudonymized identifiers (see §6) Legitimate interest (Art. 6(1)(f)): maintaining service reliability Proof of acceptance of contractual documents Terms acceptance log (terms_acceptances): identifier, document type and version, timestamp, IP address Legal obligation and legitimate interest (Art. 6(1)(c) and (f)): evidence of contractual consent Non-essential cookies and trackers Depending on your choices in the consent banner Consent (Art. 6(1)(a)) — withdrawable at any time Commercial communication (B2B prospecting) Business email Legitimate interest (Art. 6(1)(f)) — object at any time via the unsubscribe link

Ubby does not intentionally process any special categories of data (Art. 9 GDPR). Please do not submit sensitive data to agents unless specifically agreed by contract. Mandatory nature. Account and billing data are necessary to provide the service; without them, we cannot provide Ubby. Source of data. Data is collected directly from you or generated by your use of the service. Where an administrator of your organization creates your account, your identity data comes from them (Art. 14 GDPR). 3. How long do we keep your data? Data Retention period Active account and associated data Duration of the contractual relationship Deleted conversations and messages (soft-delete) Permanently erased within 30 days Inactive account Anonymized after 12 months of inactivity AI usage logs (ai_usage_audit) 90 days Admin audit logs (admin_audit_log) 1 year LLM observability traces (Langfuse) 30 days Error events (Sentry) 30 days Execution environments (Daytona sandboxes) Deleted upon account deletion Billing data (Stripe) 7 years (statutory accounting obligation) Terms acceptance log Account lifetime + statutory limitation period (5 years)

Upon account deletion, data is anonymized or erased as described in §7 (right to erasure). 4. Who receives your data? (recipients and subprocessors) Your data is never sold. It is accessible only to: authorized Ubby personnel (restricted, logged access), your workspace administrators (for data visible in the product), and the subprocessors below, strictly for the stated purposes. Subprocessor Country Purpose Transfer mechanism outside the EU Anthropic PBC United States Large language model provider (Claude) Standard Contractual Clauses (SCCs) AWS (Amazon Bedrock) EU / United States Large language model provider EU-US Data Privacy Framework certification + SCCs Google (Vertex AI) EU / United States Large language model provider EU-US Data Privacy Framework certification + SCCs OpenRouter United States LLM routing Standard Contractual Clauses (SCCs) Supabase EU (pinned region) Database, authentication, storage No transfer (EU residency) Daytona EU Execution environments (sandboxes) No transfer (EU residency) Langfuse GmbH EU (EU instance) LLM observability (pseudonymized traces) No transfer (EU residency) Sentry (Functional Software, Inc.) United States Error monitoring (pseudonymized data) EU-US Data Privacy Framework certification + SCCs Stripe United States Payment and billing EU-US Data Privacy Framework certification Composio United States Third-party tool integrations Standard Contractual Clauses (SCCs) Qovery / GitHub EU / United States Application deployment and hosting SCCs / DPF depending on the service

The up-to-date subprocessor list is published on our website and changes are notified in accordance with Article 28 GDPR. A DPA is in place with each subprocessor. Prompts and language models. Content submitted to agents is transmitted to model providers (Anthropic, AWS Bedrock, Vertex AI, OpenRouter) to generate responses. Our agreements with these providers exclude the use of your data to train their models. Authorities. We may disclose data where required by law (judicial order, competent administrative authority). 5. Transfers outside the European Union Our primary production data resides in the European Union (Supabase, Daytona, Langfuse, and EU configurations of our providers where available). Some subprocessors listed in §4 process data from the United States. These transfers are safeguarded by: the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF), for certified subprocessors; and/or the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented where appropriate by additional measures (encryption in transit, pseudonymization, minimization). You may obtain a copy of the applicable safeguards by writing to legal@ubby.ai. 6. How do we protect your data? (Art. 32 GDPR) Technical and organizational measures in place: Encryption in transit (TLS) for all exchanges. Pseudonymization of user identifiers sent to our monitoring tools (Sentry, Langfuse): identifiers are replaced by a cryptographic pseudonym (HMAC), with no personal data transmitted by default. Minimization: AI usage logs do not retain full prompt content. Encryption at rest of integration credentials (access tokens to your third-party tools). Isolation of execution environments: each agent runs in an isolated, ephemeral environment. Access control: signed token authentication (JWT), row-level security policies in the database (RLS), multi-factor authentication enforced for administrators. Logging: append-only (tamper-evident) admin audit log. EU residency of production data. No system is infallible: in the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL (the French supervisory authority) within 72 hours and, where the risk is high, inform you directly (Art. 33 and 34 GDPR). 7. Your rights You have the following rights over data for which Ubby is the controller: Access (Art. 15): obtain a copy of your data. Rectification (Art. 16): your email and profile can be edited directly in your account settings; for anything else, write to us. Erasure (Art. 17): see the details below. Restriction (Art. 18) and objection (Art. 21), including to processing based on our legitimate interest and to direct marketing. Portability (Art. 20): receive the data you provided to us in a structured, machine-readable format. Withdrawal of consent (Art. 7(3)) at any time for processing based on consent (cookies), without affecting the lawfulness of prior processing. Post-mortem directives (French Data Protection Act, Art. 85): set directives on what happens to your data after your death. How to exercise your rights. Write to legal@ubby.ai (subject line: "GDPR") from the email address associated with your account. We respond within one month, extendable by two months for complex requests (you would be informed). Identity verification may be requested in case of reasonable doubt. How erasure works in practice. When you request deletion of your account: Your account is deactivated immediately and your identity data is anonymized or erased from our production systems; Your conversations and messages are permanently erased within 30 days; Data replicated with our subprocessors (observability traces, error events, execution environments, integration credentials) is purged within their respective cycles, and at the latest within the retention periods in §3; The following is retained by exception: billing data (legal obligation, 7 years), the terms acceptance log (legal evidence), and pseudonymized security logs until their retention period expires. Some technical data is anonymized rather than erased once it can no longer identify you, directly or indirectly. Complaints. If you believe your rights are not being respected, you may lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — or with the supervisory authority of your EU member state. We encourage you to contact us first so we can resolve the issue. 8. Cookies and trackers On your first visit, a banner lets you accept or decline non-essential trackers. You can change your choices at any time via the "Manage cookies" link in the footer. Essential cookies (authentication, security, preferences): required for the service to work, not subject to consent. Analytics cookies and other non-essential trackers: set only with your consent. 9. Automated decision-making Ubby agents perform tasks on your organization's instructions and under human supervision (configurable validation rules). Ubby makes no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. 10. Minors Ubby is a strictly professional (B2B) service, restricted to persons aged 18 and over. We do not knowingly collect data about minors. If you believe a minor has provided us with data, contact us at legal@ubby.ai. 11. Changes to this policy Any material change is notified by email and/or in the product, with a request for re-acceptance where applicable. Successive versions are archived and dated. The applicable version is the one in force as of the date shown at the top of this document. 12. Contact SUCSEED SAS — Ubby 60 rue François Ier, 75008 Paris, France legal@ubby.ai (subject line: "GDPR" for any personal data request)

Version 2026-09-09