Privacy Policy

1. Scope and Applicability

This Policy applies to information processed by JetBridge in connection with:

• the Platform, including the AI-assisted vibe-coding development environment, prebuilt code components, integrations, sandbox environments, and synthetic data sets;
• our marketing websites and any other JetBridge-controlled web properties that link to this Policy;
• the JetBridge marketplace and related professional services through which you may engage members of JetBridge's vetted network — senior software engineers, fractional Chief Technology Officers, and other technical professionals (the "Engineer Services", which are fee-bearing) — and the separate invite-only directory through which you may discover independent compliance consultants, namely fractional Compliance Officers and fractional Security Officers ("Fractional Compliance Consultant Services", for which JetBridge charges no fees); the individuals in both categories are collectively referred to as "Marketplace Professionals"; and
• account registration, billing, customer support, and other communications between you and JetBridge.

This Policy does not apply to: (a) third-party websites, applications, integrations, or services that you connect to the Platform or to which we link; (b) information that you process or transmit outside the Platform after exporting or productionizing your code or applications; (c) any application or product that you build using the Platform after deployment outside JetBridge-controlled infrastructure; or (d) documents, messages, work product, or other communications exchanged directly between you and any Engineer, Fractional Compliance Consultant, or other professional or third party outside the Services (see Section 14). Your use of any third-party services is governed by those parties' terms and policies.

2. Information We Collect

We collect the categories of information described below directly from you, automatically as you use the Services, and from third parties.

2.1 Information You Provide

• Account information: name, email address, password (stored hashed), business name, role/title, country and state, billing address, and similar registration details.
• Profile and Privacy preferences: settings configured under the "Privacy" controls on your user profile, including how (and whether) projects you build on the Platform appear on jetbridge.com, project showcase opt-in/opt-out, and similar visibility preferences.
• Payment information: billing contact, taxpayer information where required, and payment-method tokens. Cardholder data is collected and processed by our PCI-compliant payment processors; JetBridge does not store full payment card numbers.
• Project, prompt, and code inputs: text prompts, instructions, code, configuration files, schemas, and other inputs you submit to the Platform (collectively, "Inputs"), and the AI-generated code, scaffolding, components, and related outputs ("Outputs").
• Synthetic data and test artifacts: synthetic patient, billing, and operational data sets (including data sets seeded by JetBridge such as Synthea-derived synthetic patient records) you generate, modify, or use for testing.
• Engineer- and Marketplace-Professional-engagement information: information you submit when scoping a project, requesting introductions to Marketplace Professionals (including engineers, fractional Compliance Officers, fractional Security Officers, and fractional CTOs), defining a Statement of Work, executing engagements, and rating or providing feedback on Marketplace Professionals.
• Communications: messages you send to JetBridge support, sales, and engineer-network coordinators, including email, in-app messages, chat transcripts, and call recordings (where you have been notified and consent is required by applicable law).

2.2 Information Collected Automatically

• Usage and Telemetry Data: Platform interactions, prompts and prompt frequency, feature usage, click and navigation events, build and deployment events, error logs, performance metrics, model latency, token consumption, and similar telemetry generated as you use the Platform.
• Device, network, and log data: IP address, browser and device type, operating system, language, time zone, referring/exit pages, session identifiers, and timestamps.
• Cookies and similar technologies: cookies, web beacons, pixels, and local storage. See Section 8 (Cookies and Tracking Technologies).

2.3 Information from Third Parties

• Identity and enterprise providers: information from single sign-on, identity, or enterprise directory providers if you authenticate using them.
• Payment processors and tax providers: payment status, fraud signals, and tax information from our processors.
• Analytics, advertising, and marketing partners: aggregated and pseudonymous information about how visitors find and use our websites, marketing campaign attribution, and similar data.
• Marketplace network sources: professional history, references, work samples, certifications, licensure information, and vetting evaluations submitted by Marketplace Professionals in our network (engineers, fractional Compliance Officers, fractional Security Officers, and fractional CTOs).
• Public sources: publicly available information from corporate registries, professional networking sites, and the open web for marketing, anti-fraud, and account verification purposes.
• Data Product sources: professional and business contact information about third parties (such as investors, accelerators, and other business contacts) compiled from public sources and licensed data providers, which we make available to paying customers as Data Products for their recruiting, fundraising, and sales or marketing purposes (see Terms of Service Section 4.6).

2.4 Sensitive and Special-Category Information

JetBridge does not request, and the Platform is not designed to receive, sensitive personal information, government identifiers, financial-account numbers (other than tokens for payment), biometric identifiers, precise geolocation, or special-category data under the GDPR or similar laws. You are responsible for ensuring that you do not submit such information through the Platform unless you have an executed BAA or other appropriate written agreement specifically permitting that processing. If you submit such information without authorization, you indemnify and hold JetBridge harmless from claims arising from that submission, as further set forth in our Terms of Service.

2.5 Children’s Information

The Services are intended for business and professional use and are not directed to children under 18. JetBridge does not knowingly collect personal information from children under 18. If you believe a child has provided personal information to JetBridge, please contact us at privacy@jetbridge.com and we will delete it promptly in accordance with applicable law.

3. How We Use Information

We use the information we collect for the purposes described below, in each case under one or more of the legal bases set forth in Section 11.

• To provide and operate the Services: authenticate accounts, deliver the Platform, generate AI Outputs from your Inputs, run sandbox environments, host synthetic data sets, support integrations, deliver Engineer Services introductions, and operate billing.
• To improve and develop the Services: analyze Usage and Telemetry Data, debug, profile and benchmark the Platform, evaluate model and feature quality, A/B test, and develop new features, integrations, and offerings, including improvements to our Engineer Services and engineer-vetting processes.
• To train, fine-tune, and evaluate AI models, subject to the limitations in Section 4: improve the AI capabilities of the Platform, including through evaluation, benchmarking, fine-tuning, retrieval augmentation, and reinforcement learning techniques.
• To provide support and communicate with you: respond to inquiries, send service announcements, deliver security and privacy notices, provide technical support, and notify you of updates.
• To bill, collect, and prevent fraud: process payments, calculate taxes, manage accounts, prevent fraud, abuse, and unauthorized access, and enforce our agreements.
• To market and promote the Services: send marketing communications (subject to your preferences), measure marketing effectiveness, run events and webinars, and feature opted-in projects on jetbridge.com or related properties.
• To comply with law and protect rights: comply with legal obligations, respond to lawful requests, enforce our terms, protect our and others’ rights, property, and safety, and respond to claims and disputes.
• For corporate transactions: evaluate, negotiate, and conduct mergers, acquisitions, financings, reorganizations, sales of assets, bankruptcies, or similar transactions involving JetBridge.
• For aggregated and de-identified analytics: produce statistical, aggregated, or de-identified information that no longer identifies you or any individual; we may use and share such information for any lawful purpose without restriction.

4. Customer Intellectual Property, AI Training, Inputs, and Outputs

JetBridge respects customer intellectual property and takes a deliberately conservative approach to using customer information for AI training. The following terms govern how Inputs, Outputs, and related data may be used by JetBridge for model training, fine-tuning, evaluation, and product improvement.

4.1 No Training on PHI or Real Patient Data

JetBridge does not train, fine-tune, evaluate, or otherwise use Protected Health Information, real patient data, or any individually identifiable health information you may submit (in violation of these terms) to develop or improve our AI models. In the event that any such information is identified in customer Inputs, JetBridge will treat it in accordance with the BAA (if executed) or, in the absence of a BAA, will isolate, quarantine, or delete the data in accordance with our internal incident-response procedures. The Platform is intended for synthetic data only.

4.2 Synthetic Data Sets

JetBridge may use, retain, and analyze synthetic data sets that we generate or seed, including Synthea-derived synthetic patient records and synthetic billing data sets, for any product, research, training, or evaluation purpose, without restriction. You acknowledge that such synthetic data does not relate to any identifiable individual.

4.3 Usage Data and Billing-System Data Used to Improve the Services

Subject to Sections 4.1 and 4.4 (including the best-efforts non-training commitment for paid accounts), you acknowledge and agree that JetBridge may collect, retain, analyze, and use the following information to operate, secure, evaluate, develop, train, fine-tune, and improve the Platform, the Engineer Services, and JetBridge’s other products and services:

• Usage and Telemetry Data, meaning behavioral and operational metadata about how the Services are used — such as prompt frequency, length, timing, and category statistics ("prompt patterns"), feature interactions, build, deployment, and error events, latencies, and token consumption — which, for paid accounts, excludes the substantive content, sequence, or structure of your Inputs and Outputs (such as the text of your prompts, code, designs, schemas, UI/UX layouts, or feature specifications, or the ordered series of prompts and revisions by which you developed your application);
• Billing-system data, including amounts charged, plan tier, subscription history, invoice metadata, taxes, and similar transactional information (excluding cardholder data and payment-card numbers);
• Aggregated, anonymized, or de-identified information derived from Inputs, Outputs, or Usage Data, in each case in a form that does not identify you or any individual and cannot reasonably be used to reconstruct your applications, product concepts, or intellectual property; and
• Engineer- and Marketplace-Professional-engagement metadata, including project scoping data, ratings, feedback, throughput, and engagement outcomes for engineers, fractional Compliance Officers, fractional Security Officers, and fractional CTOs (excluding the substance of your code, customer or end-user data, or any Marketplace Professional's privileged work product).

No circumvention. For the avoidance of doubt, nothing in this Section 4.3 permits JetBridge to use usage or telemetry data in a manner that circumvents Section 4.4. In particular, for paid accounts, JetBridge will not use the substantive content, sequence, or structure of your prompts, builds, or design iterations to train models in a manner intended or reasonably likely to enable other customers or third parties to reproduce, or more efficiently recreate, your application, UI/UX, design, or feature set.

4.4 Customer Inputs, Outputs, and Intellectual Property — Best-Efforts Non-Training Commitment (Paid Accounts)

JetBridge respects your intellectual property. For accounts on a paid Subscription Plan and in good standing: (i) JetBridge does not use the substantive content of your Inputs or Outputs (including your code, prompts, and configuration files) to train, fine-tune, or develop foundation or shared AI models for the benefit of other customers (except as permitted below); and (ii) more broadly, JetBridge uses commercially reasonable best efforts not to use the substantive content of your Inputs or Outputs — including prompts, code, designs, schemas, and product or business concepts — in any manner intended or reasonably likely to enable JetBridge, other customers, or third parties to reproduce, recreate, or reverse-engineer your applications, ideas, or other intellectual property. This mirrors, and is subject to, Section 7.1 of the Terms of Service.

This is a best-efforts commitment, not a guarantee. JetBridge cannot ensure that your ideas, intellectual property, or applications will remain confidential or non-replicable, particularly given your own choices about what to submit, publish, and deploy. In particular: (a) the commitment applies only to paid accounts in good standing and not to the free "Resident" tier or other unpaid, trial, or Beta access, for which JetBridge may use Inputs and Outputs to develop and improve the Services and its models as otherwise permitted by our Terms of Service; (b) it does not apply to anything you or your Authorized Users choose to publish, deploy publicly, showcase, submit, or otherwise disclose — including by publishing or listing an application on AirCode, the Marketplace, a project showcase, or any public, third-party, or community site (including properties operated by JetBridge or AirCode) — all of which are disclosures made by your own choice and for which you are responsible for configuring appropriate privacy and access controls; (c) JetBridge may still process Inputs and Outputs to provide, secure, and support the Services, debug incidents you report, detect and prevent abuse and fraud, comply with law, and generate aggregated or de-identified analytics that cannot reasonably be used to reconstruct your intellectual property; (d) it does not restrict uses to which you expressly opt in or the use of de-identified and aggregated data; and (e) it does not apply to any Self-Hosted Deployment you operate (see Section 4.6), the security and confidentiality of which depend on your own environment, configuration, and personnel.

Independent development and similar ideas. Software ideas are frequently conceived independently and concurrently by many people, and the Platform is used by many customers, some of whom may independently build applications or features similar or identical to yours without any access to your Inputs or Outputs; AI models may also produce similar Outputs in response to similar prompts from different users. The existence of a similar application or idea — on the Platform or elsewhere — is not, by itself, evidence that JetBridge or anyone else accessed or misappropriated your information, and JetBridge is not responsible for any third party's independent development of similar ideas or products. This mirrors Section 7.1 of the Terms of Service.

Your disclosures and your duty to protect your own IP. Your ideas may also be disclosed through channels JetBridge does not control — including when you publish or showcase your application on AirCode, post to public or community sites, pitch or discuss your ideas with others, or disclose them to Engineers, Fractional Compliance Consultants, or other professionals you speak with or engage through the Marketplace. It is solely your responsibility, with the advice of your own legal counsel, to decide what protections your ideas need and to obtain and enforce them — including non-disclosure agreements, confidentiality and IP-assignment agreements signed by the people you disclose to, and registrable protections such as patents, trademarks, and copyrights. JetBridge is not a party to any such agreement and has no liability for any use or alleged misappropriation of your ideas by any customer, professional, or other third party.

Ultimate responsibility rests with you. The protection of your ideas, intellectual property, and applications ultimately rests with you, including your decisions about what to submit, build, publish, deploy, and disclose, to whom, and under what contractual protections, and how you configure privacy and access controls. JetBridge's undertakings in this Section are limited to commercially reasonable best efforts for paid accounts in good standing and are provided without warranty or guarantee of result.

4.5 Third-Party AI Model Providers

The Platform may use third-party AI model providers as subprocessors to deliver inference, embeddings, or similar capabilities. We require these subprocessors to provide written commitments that customer Inputs and Outputs delivered through their APIs will not be used to train their public models. The list of subprocessors is available on request and may be updated from time to time.

4.6 Self-Hosted and Customer-Managed Deployments (Enterprise)

Under a separate enterprise arrangement, JetBridge may offer you the option to host or run JetBridge's AI harness, models, or other Platform components within your own environment, infrastructure, or devices (a "Self-Hosted Deployment"). In a Self-Hosted Deployment, Inputs, Outputs, and related data are processed within your environment and under your control. You are solely responsible for the security, configuration, access controls, and lawful operation of a Self-Hosted Deployment. JetBridge does not control, monitor, or have visibility into a Self-Hosted Deployment and cannot and does not guarantee the security, privacy, or confidentiality of, or the protection of intellectual property within, any Self-Hosted Deployment; many such risks arise from user error or user choice outside JetBridge's control.

5. How We Share Information

JetBridge shares information only as described in this Policy. We do not sell our customers' personal information or Customer Data unless you explicitly ask or direct us to share it — for example, for investor relations, developer introductions, or sales- or marketing-related introductions, as described below. We may share information in the following circumstances:

• Service providers and subprocessors: hosting, cloud infrastructure, AI model providers, analytics, telemetry, error monitoring, payment processors, customer support, email and communications, and similar vendors that process information on our behalf under written agreements that restrict their use of the information.
• Advertising conversion-measurement partners: to measure the effectiveness of our advertising, we share a cryptographically hashed (SHA-256) form of your email address together with ad-click identifiers (such as Google’s gclid or Meta’s fbclid) with advertising partners, including Meta and Google, solely to attribute signups and subscription purchases to the ad campaigns that drove them.
• Engineer Marketplace (engineers and fractional CTOs) and Fractional Compliance Consultant directory (Compliance Officers and Security Officers): these are two distinct offerings. For the Engineer Marketplace, JetBridge facilitates fee-bearing introductions of senior software engineers, fractional Chief Technology Officers, and other technical professionals, and may act as the contracting party or referral intermediary as set out in ToS Section 11.1. For the Fractional Compliance Consultant directory, JetBridge provides only an invite-only directory listing through which you may discover independent compliance consultants — the engagement, if any, is solely between you and the Fractional Compliance Consultant, and JetBridge does not financially intermediate or charge fees. In either case, to enable the engagement JetBridge shares information necessary to scope it, including your contact information, project description, role you wish to fill, and (with your consent) selected Inputs or Outputs. Anything further you choose to disclose to an Engineer, Fractional Compliance Consultant, or other professional in the course of an engagement is disclosed by you at your own election and risk; you are responsible for any non-disclosure or confidentiality agreement you determine is needed (see Section 4.4). Where the engagement involves access to information you maintain in your JetBridge account (including, where authorized, ePHI under an executed BAA), that access is governed by your own access controls within your account; the engaged professional is for those purposes a workforce member (or, where applicable, a subcontractor or business associate) of you, and is not a subcontractor of JetBridge under your BAA. For Engineer Marketplace engagements, JetBridge handles payments: JetBridge (via its PCI-compliant payment processors) collects the engineer's fees plus JetBridge's marketplace fee from you and remits the engineer's portion to the engineer, and processes related billing and transaction data for that purpose. The contractual terms governing engineer engagements are in ToS Sections 11.1–11.7 and 11.9; Fractional Compliance Consultant engagements are governed by ToS Section 11.8 and, where applicable, your BAA.
• Affiliates: with present and future JetBridge affiliates, parents, subsidiaries, and corporate group entities for purposes consistent with this Policy.
• Legal, regulatory, and protective disclosures: to comply with law, legal process, or governmental requests; to enforce our agreements; to investigate and prevent fraud, abuse, or security incidents; or to protect the rights, property, or safety of JetBridge, our customers, or others.
• Corporate transactions: in connection with the negotiation or completion of a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction.
• With your direction or consent — including customer-directed introductions: with third parties when you instruct us, including by enabling integrations, opting in to project showcase features, or providing other express consent. In particular, if you explicitly request it, we will share your information (such as your name, company, contact details, and materials you designate, such as a pitch deck or job posting) with investors, developers, or sales or marketing prospects in order to make introductions in support of your investor-relations, recruiting, fundraising, or sales and marketing efforts. Such introductions are made only at your request or direction, and you may withdraw a standing introduction request at any time for future introductions.
• Aggregated or de-identified information: with any third party for any lawful purpose, in a form that does not identify you or any individual.

6. Project Showcase and Public Visibility

You can configure visibility of your projects under the "Privacy" tab on your user profile. Subject to your selected settings, JetBridge may feature, link, or display certain attributes of your projects (such as project name, screenshots, or summaries) on jetbridge.com, aircode.build, or related marketing properties. You may change these preferences at any time through your account settings; provided that JetBridge is not obligated to remove information that has already been distributed publicly, cached by third parties, or used in marketing materials disseminated prior to your change.

Publishing, listing, deploying, or showcasing an application — whether on AirCode, the Marketplace, a project showcase, or any public or third-party site — necessarily discloses aspects of your application, ideas, and intellectual property. Any such publication is made at your election, and you are solely responsible for deciding what to make public and for configuring appropriate privacy, visibility, and access controls beforehand. As described in Section 4.4, materials you choose to publish or disclose fall outside JetBridge's best-efforts non-training commitment.

7. Data Retention

JetBridge retains personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, enforce our agreements, and protect our rights. Specific retention periods depend on the type of information, the purpose for which it was collected, and applicable legal requirements. Examples include:

• Account information: for the life of your account and for a reasonable period thereafter.
• Inputs, Outputs, and project data: until deletion by you, account closure, or as required for backups, security, audit, and legal-hold purposes.
• Usage and Telemetry Data, billing data, and aggregated analytics: for a period that supports our legitimate business and product-improvement purposes, which may exceed account closure.
• Compliance, legal, tax, and audit records: for the periods required by applicable law.

When information is no longer needed, we will delete or anonymize it in a commercially reasonable manner. Backup copies and archived records may persist for additional periods consistent with our retention schedule.

8. Cookies and Tracking Technologies

We and our service providers use cookies, pixels, web beacons, software development kits, local storage, and similar technologies to operate the Services, remember your preferences, authenticate you, measure performance and engagement, and (where permitted) deliver and measure marketing. You can control cookies through your browser settings and, where required by law, through a cookie-consent or preference banner provided on our websites. Disabling certain cookies may impair functionality of the Services.

We also operate first-party product analytics on our websites and the Platform. We assign your browser a persistent device identifier, stored in local storage and in a cookie that persists for up to two years, and we keep a first-party record of product events (such as page views, clicks, and actions you take on the Platform) associated with that identifier. If you create an account, we associate that device's earlier activity with your account so we can understand how people find and start using the Platform. This record is retained on a rolling basis and then deleted.

Where your browser sends a Do Not Track or Global Privacy Control signal, we do not write your activity into that first-party record. The signal does not prevent the device identifier itself from being assigned or persisted, and it does not extend to event data we send to our analytics service providers, who continue to receive it regardless of the signal.

9. Security

JetBridge implements administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction. These safeguards include encryption in transit and (where applicable) at rest, role-based access controls, logging and monitoring, secure software development practices, and personnel training. No security program is impenetrable, and JetBridge cannot guarantee the absolute security of any information. You are responsible for safeguarding your account credentials and for the security of any environment to which you export Outputs or where you deploy applications you build with the Platform.

10. International Users and Cross-Border Transfers

JetBridge is headquartered in the United States and operates primarily from facilities and infrastructure located in the United States. By using the Services, you understand that your information will be transferred to, stored, and processed in the United States and other countries that may have data-protection laws different from those of your country of residence. Where required by applicable law, JetBridge relies on appropriate safeguards for cross-border transfers, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions, where applicable), or other lawful mechanisms.

11. Legal Bases for Processing (EU/UK Users)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, JetBridge processes personal information based on the following legal bases:

• Performance of a contract: to provide the Services to you and to take steps at your request before entering a contract.
• Legitimate interests: to operate, secure, improve, and develop the Services; to communicate with our customers and prospects; to prevent fraud and abuse; and to conduct our business, in each case where those interests are not overridden by your rights.
• Compliance with legal obligations: to comply with applicable law, regulations, court orders, and enforceable governmental requests.
• Consent: where required, including for marketing communications and certain cookies. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

12. Your Privacy Rights

Depending on where you reside, you may have certain rights with respect to your personal information. JetBridge will honor verifiable requests in accordance with applicable law.

12.1 California, Colorado, Connecticut, Virginia, Utah, and Other U.S. State Rights

Subject to applicable law and with appropriate verification, you may have the right to:

• know or access the categories and specific pieces of personal information we process about you;
• correct inaccurate personal information;
• delete personal information, subject to permitted exceptions;
• obtain a portable copy of personal information you provided to us;
• opt out of "sales" or "sharing" of personal information for cross-context behavioral advertising, and of certain types of profiling and targeted advertising;
• limit the use of sensitive personal information; and
• be free from unlawful discrimination for exercising these rights.

"Sale" / "Share" Disclosure. JetBridge does not sell your personal information for monetary consideration and does not knowingly engage in "sharing" for cross-context behavioral advertising, as those terms are defined under California law. Disclosures we make at your explicit request or direction — such as customer-directed introductions to investors, developers, or sales or marketing prospects (see Section 5) — are made at your direction and do not constitute a "sale" under California law. Where required, you may submit an opt-out request via the methods described in Section 15.

12.2 EU/UK/Swiss Rights

Where applicable, you have the right to access, rectify, erase, restrict or object to the processing of your personal information, request portability, and lodge a complaint with your supervisory authority. To exercise these rights, contact privacy@jetbridge.com.

12.3 Authorized Agents and Verification

You may authorize an agent to submit a request on your behalf, subject to verification of identity and authorization. We may decline requests that we cannot verify, that are unduly burdensome or repetitive, or that we are otherwise permitted by law to deny.

13. Automated Processing and Profiling

JetBridge does not engage in automated decision-making producing legal or similarly significant effects on individuals. Some of our anti-fraud, abuse-detection, and engineer-matching processes use automated tools; we apply human review when required by law and you may contact us to obtain meaningful information about the logic used.

14. Fractional Compliance Consultant Directory

JetBridge maintains an invite-only directory (the "Directory") through which Customers may discover independent compliance consultants — fractional Compliance Officers and fractional Security Officers (each a "Fractional Compliance Consultant") — whom Customers engage directly. JetBridge charges no fees for, does not process payments for, and is not a party to those engagements. (This is distinct from the Engineer Marketplace — senior software engineers, fractional CTOs, and other technical professionals — which is fee-bearing and governed by ToS Sections 11.1–11.7 and 11.9.) The full terms governing Fractional Compliance Consultant engagements, including the allocation of responsibility and liability and the Customer's duty to verify credentials and consult its own legal counsel, are set out in ToS Section 11.8.

Information about consultants. To populate Directory listings, JetBridge may collect from Fractional Compliance Consultants information such as professional history, references, work samples, certifications, and licensure, and may share that information with Customers consistent with the consultant's listing-time consent. Listings may be based in whole or in part on self-reported information that JetBridge has not verified, and a listing is not an endorsement or certification; Customers are responsible for their own due diligence.

Engagements occur off-platform. Documents, work product, and communications exchanged between a Customer and a Fractional Compliance Consultant occur outside the Services, through channels they choose; JetBridge does not host, process, or have visibility into them, and they are not covered by this Policy (see Section 1). If a Customer, at its own election, grants a consultant access to materials in the Customer's account (including, where authorized, ePHI under an executed BAA), that access is governed by the Customer's own access controls; for purposes of HIPAA, the consultant is a workforce member (or subcontractor or business associate) of the Customer during the engagement, and is not a subcontractor of JetBridge under any BAA.

15. Contact and Submitting Requests

Questions about this Policy or requests to exercise your rights should be directed to:

16. Changes to This Policy

JetBridge may revise this Policy from time to time. The "Last Updated" date above indicates when this Policy was last revised. Material changes will be communicated through reasonable means, which may include in-app notice, email, or notice on https://aircode.build. Your continued use of the Services after any change becomes effective constitutes your acknowledgement of the revised Policy. If you do not agree to a change, you must stop using the Services.

17. Order of Precedence and Conflicts

In the event of a conflict between this Policy and an executed BAA, the BAA controls solely with respect to information that constitutes Protected Health Information. In the event of a conflict between this Policy and a separately executed enterprise data-processing addendum or master subscription agreement, the more specific written agreement controls.