Privacy Policy.

This Privacy Policy explains how Decentralized Technologies, Inc., operating as dectec ("we," "us," or "our"), handles personal information in connection with the Twin Portal and Twin services and technology it provides. Personal information means information that identifies, relates to, or can reasonably be linked to a person or household, as applicable law defines it.

The Services are offered to eligible U.S. adults age 18 and older and U.S. organizations. U.S. customer eligibility does not mean all processing necessarily occurs in the United States. Our Terms of Service address service use; this Policy is a notice of data practices, not a waiver of privacy rights or a substitute for consent required for a particular activity.

1. Scope and our role

This Policy covers personal information processed through dectec-provided Twin Portal accounts, Twin Vault, file storage and search, Ask AI, chat, AI twins and supported voice/avatar features, content tools, authorized agents, integrations, APIs, SDKs, subscriptions, points, payment administration, support, and related commercial tools. It applies to personal information about individual customers, organizational users, partner contacts, prospects, and people whose information is lawfully supplied to an enabled service.

It does not automatically govern an independent company's website, app, model, wallet, or payment service simply because it integrates with us or uses Twin branding. That provider's role, agreement, and privacy practices also matter. Nor does it cover employment records of dectec's own personnel where a separate personnel notice applies.

We determine how to process account, billing, support, security, and business-contact information for our service operations. Where we process an organization's hosted content solely on its documented instructions, our role may instead be that of a service provider or processor under the applicable contract and law. The organization remains responsible for its own notices, instructions, and decisions. We assist with requests as required; we do not require every user to resolve all privacy concerns with a partner before contacting us.

2. Information we collect and its sources

We collect information from you, your authorized users, a properly authorized organization or provisioning partner, the devices and browsers used to access the Services, connected services you authorize, and service or transaction providers supporting your use. We do not treat account provisioning as consent to every optional disclosure or marketing activity.

2.1 Account and business details. Name, email, ordinary contact details, organization, role, account identifiers, account preferences, eligibility statements, invitations, administrative assignments, and authentication or access records. Registration and recovery processes can involve information that law treats as sensitive, even though general sensitive-content uploads are prohibited.

2.2 Customer Content. Uploaded or connected documents, files, ordinary contact records, prompts, conversations, instructions, knowledge bases, authorized brand materials, and supported media. Processing may produce extracted text, transcripts, summaries, indexes, embeddings, source references, and AI outputs. Content may concern you or others; submit it only with appropriate authority and within the restrictions in Section 3.

2.3 AI and agent activity. Requests and answers; chosen models and tools; connected-account identifiers and granted permissions; schedules and task status; actions taken on files or through integrations; interaction or consent records; and usage and error information. Where a configured feature performs matching, recommendations, or personalization, outputs may include inferred preferences or assessments based on the permitted inputs. Those assessments are not necessarily accurate.

2.4 Credentials supplied through approved connections. A designated connection feature may receive a scoped API key or access token that you authorize us to use. That is different from uploading passwords, private keys, or seed phrases as general content. Credential handling and connected-provider processing are described in Section 5.

2.5 Commercial and payment records. Plans, purchases, invoices, billing contact details, subscription events, points balances and usage, transaction identifiers, payment status, and dispute or refund records. Cryptocurrency payments may involve public wallet addresses, asset and network information, transaction hashes, amounts, and confirmations. Exact payment fields received by dectec versus an independent processor depend on the implemented payment flow; do not assume we receive complete card data or control a customer's wallet.

2.6 Portal activity and analytics. Page views, document downloads, calculator entries, demo interactions, conversations with portal assistants, IP addresses, browser and device details, timestamps, navigation, interaction events, and session recordings or replays. These records can be associated with a signed-in account and organization. Section 7 explains tracking and required controls.

2.7 Communications. Support messages, privacy requests, feedback voluntarily submitted to us, sales and demo inquiries, preferences for follow-up, and correspondence needed to resolve a request. Audio/video recording of an actual call or meeting is separate from web session replay and requires appropriate notice and consent where applicable.

2.8 Additional sources and future data products. We may receive transaction status from a payment service or permitted content from a service you connect. A future audience-data enrichment or licensing program is not authorized by a blanket reference to partners. Before adding such a program, we must establish the necessary data rights and provide applicable disclosures and consent choices. This Policy does not represent that any contemplated audience-data provider or technology integration is already operating.

3. Sensitive information, media, and information about minors

Do not place government identification numbers or scans, financial access credentials, full payment-card data or security codes, medical records, highly sensitive health data, genetic information, biometric identifiers/templates, precise location histories, children's personal information, intimate personal records, private wallet keys, or seed phrases into general Vault content, prompts, chat, or support messages.

Ordinary registration details and information submitted in an expressly designated payment or scoped-credential connection flow are limited exceptions for those purposes. These flows are not permission to upload unrelated sensitive material.

Voice recordings, images, and identifiable avatars must be supported by the rights and authorizations required for the relevant feature. A general content license does not authorize undisclosed biometric derivation, voiceprint identification, or face-template processing. Where such processing is involved, separate feature disclosures, consent where required, and retention rules must be in place before collection.

For authorized voice and avatar features, submitted recordings, images, scripts, and related service data may be processed by dectec and the providers supporting the selected feature to produce the requested voice, avatar, or Twin experience. Use is limited to that authorized purpose, service support, security, and legal obligations. A separate identification, biometric-template, or recognition use is not permitted under the general content license; it requires the legally necessary feature-specific disclosures and authorization before collection or processing. You may request that an enabled feature be stopped and associated data deleted through the email address in Appendix A. Section 9 applies to retained copies, subject to any shorter biometric or other statutory period.

The Services are not directed to people under 18, and minors may not create or use accounts under these Terms. Do not provision an account for a child or upload a child's personal information. If we learn that information has been collected contrary to these restrictions, we will take appropriate steps to restrict processing and delete information as required by law. Report a concern through Section 15 without unnecessarily repeating the sensitive material. Prohibiting an upload does not remove legal protections from information we actually receive.

4. Why we use information

We use personal information for the following purposes, as relevant to the requested Service and permitted by law:

Service delivery. Creating and administering accounts; storing, organizing, finding, and retrieving authorized content; producing requested AI outputs; providing supported Twin experiences; and carrying out authorized instructions and integrations.

Account and partner administration. Associating a user with an organization, maintaining authorized permissions, supporting provisioned accounts, implementing service configurations, and communicating about access or the applicable program.

Transactions and usage. Measuring service consumption, maintaining points and usage records, billing authorized charges, recording crypto payment status, responding to billing disputes, and keeping necessary financial records.

Support and business follow-up. Answering requests, providing demos, understanding a prospect's stated needs and use of portal materials, and following up about relevant services, subject to applicable communication rules and choices. Internal sales staff may use account-linked portal activity for this purpose. Partner access is limited by the actual authorized configuration and Section 6.

Reliability and protection. Troubleshooting, diagnosing failures, monitoring performance, understanding use of features, detecting abuse and fraud, protecting systems, maintaining appropriate records, and enforcing lawful service restrictions.

Legal and rights administration. Handling privacy and copyright requests, satisfying legal obligations, responding to valid legal process, and establishing, exercising, or defending legal claims.

Operational analytics and debugging are distinct from training a model for unrelated users, creating a commercial dataset, or advertising uses. Those practices require the specific disclosure in Section 5 or 8; this purpose list does not supply blanket permission for them.

5. AI providers, API keys, and model-training uses

5.1 Requested AI processing. When you ask a question, generate a Twin output, or authorize an agent, the service may retrieve permitted information and transmit the request, relevant context, tool results, and necessary metadata to the selected model or service provider. The output and related activity can be stored in your account. Using a Vault does not mean data never leaves it or that no provider sees the context used for a request.

5.2 User-supplied accounts. With your own LLM key, model calls use the connected provider account according to the actual configuration. That provider's account settings and terms can affect retention, usage, billing, and processing. dectec processes the credential and relevant data only within the authorized service purpose, subject to applicable duties. Use the designated connection flow and provider-side safeguards; never disclose raw credentials in general content.

Credential and provider handling. A supplied key or access token may be used and retained only for the authorized connection and necessary security or troubleshooting. Access must be limited to personnel and service components with a legitimate operational need. Credentials must not be repurposed for unrelated accounts, content, or charges. After disconnection or account closure, we stop new use and remove the usable credential from active connection systems without unnecessary delay; restricted backup or security copies follow Section 9. You should also revoke or rotate the credential at its issuing provider. Authorized model providers may receive prompts, relevant context, tool results, and metadata needed for the request. Hosting, storage, content-processing, and support providers may process the data needed for their functions. Provider and connection-handling information applicable to your Service may be requested through Appendix A before authorizing a connection. No particular encryption, zero-access architecture, or provider retention period is promised by this paragraph.

5.3 Shared-model training and secondary exploitation. Processing content to answer your request is different from training or improving a general model for other customers, licensing a dataset, or exploiting your content for unrelated advertising. The content license in the Terms is not blanket authorization for those secondary purposes.

Under this Policy, dectec will not use Customer Content, private prompts, outputs, recordings, or likeness materials to train a general-purpose or shared model for unrelated users without a separate, specific, voluntary opt-in. Processing and adaptation needed to provide your expressly requested personal Twin or private service is distinct from that secondary training use. Operational debugging and service analytics remain limited to the purposes described here. Contracted providers processing on our behalf must be restricted to their authorized purposes. A model or other independent service you select may apply its own account terms and settings; review them before connecting it. You may withdraw a separate optional training consent prospectively through the email address in Appendix A. Withdrawal does not promise removal of information from an independently operated model beyond rights and remedies actually available under law and the applicable provider arrangement.

5.4 Agent control. Tools may read or modify content, send communications, operate connected applications, delegate work, or perform supported transactions only within the relevant authorization. Review the data scope and action permissions before enabling a task. You can withdraw authorization through supported controls and the connected provider. Revocation does not erase information already legitimately delivered or reverse an irrevocable action, but it does not authorize new unrelated processing.

5.5 Automated assessments. Recommendations and match explanations may be derived from permitted information. They are not a guarantee of a person's attributes or suitability. Where a use constitutes regulated profiling or automated decisionmaking, applicable notice, access, objection, or opt-out requirements must be met. This Policy does not by itself authorize an unreviewed significant decision about employment, credit, housing, or another regulated opportunity.

6. How information is disclosed

6.1 Suppliers acting for us. We disclose information necessary for hosting, storage and content processing; model and agent functionality; security; support; analytics and session replay; communications; and billing or payment administration, to suppliers supporting those functions. Applicable contractual and legal restrictions govern processing on our behalf. Engaging a vendor does not eliminate duties imposed on dectec.

6.2 Your authorized recipients. A person, organization, Vault, app, or service may receive content when you authorize sharing, connect it, or approve an agent action. Participation in networking or a matching service does not by itself authorize public release of contact details. Check the recipient, purpose, and information scope. A legitimate recipient may retain an independent copy under its own obligations after delivery.

6.3 Organization and partner administrators. Managed-account administrators can receive information to the extent their actual permissions, contractual authority, and disclosed role permit. Their access may include account status, plan or usage information, or content where specifically authorized. Creation or sponsorship of a Vault alone does not grant every partner unrestricted viewing rights. An administrator's monitoring obligations to its own users remain its responsibility.

6.4 Affiliates and advisers. Information may be made available to authorized affiliate personnel providing an actual operational function, and to advisers where reasonably necessary for the stated purpose and subject to appropriate restrictions. Our AiFi relationship does not mean the parent automatically receives all Vault content.

6.5 Legal, safety, and business transfers. Information may be disclosed as legally required, in response to valid process, to address fraud or protect rights and safety where legally permitted, or in a lawful merger, reorganization, financing, asset transfer, or similar transaction. Appropriate restrictions and continuing privacy obligations apply. A business transfer does not automatically eliminate existing privacy choices.

6.6 Public systems. A supported cryptocurrency payment may put transaction information on a public blockchain, where it can be visible beyond dectec and persist. You should not put personal content or secrets into a public transaction memo. Decentralized storage and blockchain are not interchangeable, and this Policy does not say all Vault files are stored publicly or directly on-chain. Storage-provider and access details are provided in Section 5.

7. Cookies, session replay, and portal tracking

We track portal use including pages viewed, downloads, calculator inputs, demo activity, conversations, IP/device information, and session interactions. This can help us operate the portal, troubleshoot, understand service interest, and follow up with prospects. Session replay can reconstruct interaction sequences; it is distinct from a live human observing a call. Some tracking may be provided by third-party tools that receive the related data.

Recording limits and retention. Portal recording may capture navigation, page interactions, calculator entries, demo activity, and assistant interactions for the purposes stated above. Session replay is permitted only on screens and fields configured to exclude credential-entry fields, payment security data, and private Vault file contents. If those exclusions cannot be maintained for an area, replay must remain disabled for that area. This does not prevent separately authorized processing of content to deliver a requested AI or storage feature. Recordings must be deleted no later than 90 days after capture unless a specific legal, security, or documented dispute-preservation need requires restricted retention. Other identifiable interaction and technical logs follow Section 9. We do not promise that every prohibited sensitive upload can be detected. Tracking-provider and recording-scope information may be requested through Appendix A.

Where consent is required before recording or nonessential tracking, we will present the required notice and obtain consent before that activity begins. A general acceptance of the Terms or visit to the portal does not replace that consent. Essential security and service records are distinguished from optional recording and marketing uses.

To request information about cookies, recording, or tracking, or to withdraw optional consent, use the email address in Appendix A. No special subject line is required. We will apply applicable choices prospectively without unnecessary delay and within required legal periods. Browser controls may limit cookies but do not necessarily stop server-side records. Essential functions may depend on required technologies. An email request supplements, rather than displaces, any in-service or automated control required by applicable law.

Recognized opt-out preference signals, including Global Privacy Control where applicable, will be processed as required for covered sale, sharing, or targeted advertising. Traditional browser "Do Not Track" signals are different; this Policy does not promise a separate technical response to every such setting. You may communicate a choice using the email address in Appendix A. Neither an opt-out signal nor an email opt-out requires discontinuing essential security records or closes your account.

8. Sale, sharing, targeted advertising, and incentives

Privacy laws may treat certain disclosures as a "sale," "sharing," or targeted advertising even without a conventional sale for money. Supplier analytics, advertising arrangements, and some partner disclosures must be evaluated by their actual use, contracts, and applicable law.

This Policy does not permit dectec to sell personal information or disclose it for cross-context behavioral advertising or targeted advertising. Information may still be disclosed to contracted service providers for the permitted business purposes in Section 6, to recipients you specifically direct, or where law permits or requires it; those disclosures must not be used to evade an applicable sale or sharing restriction. General acceptance of the Services does not authorize an unrelated commercial data program. Any future change involving a covered sale, sharing, targeted advertising, or financial incentive requires an accurate updated notice, applicable opt-out mechanisms, and any legally required separate consent before the change applies.

Use the email address in Appendix A to opt out of any legally covered sale, sharing, targeted advertising, or optional data use, or to ask about this Policy. We will honor applicable rights and recognized preference signals without requiring an unnecessary account or identity document. Opting out of targeted advertising is distinct from unsubscribing from direct communications.

Current account access does not create a right to payment for information, matches, or interactions. Future financial incentives or user-payout programs, if offered, will need their own material terms, required privacy notices, choices, and lawful participation process. Joining a service or receiving a partner-created Vault is not automatic enrollment in such a program.

9. Retention, closure, and deletion

We retain information only for the purposes described in this Policy, as necessary for the account or requested service and applicable legal obligations. The criteria differ by category:

Customer Content and derivatives. Stored while needed to provide the active account and requested features, subject to deletion instructions and legal rights. When the account closes, controllable content, extracted text, transcripts, indexes, embeddings, and associated copies are deleted within six months, except narrowly justified retention below.

Account and administrative data. Kept while necessary to administer the relationship. Personal information attributable solely to a closed account is ordinarily deleted within the same six-month ceiling unless a specific exception applies.

Credentials. Used only for the authorized connection. On disconnection or closure we stop new use and remove usable credentials from active connection systems without unnecessary delay. Restricted residual copies may remain only for necessary backup, security, or legal purposes under the applicable deletion schedule, ordinarily no longer than six months after closure unless a lawful exception applies. You should also revoke access at the provider. No retention period authorizes continued use of a disconnected key.

Portal analytics, recordings, and technical logs. Session recordings follow the 90-day maximum in Section 7. Other identifiable analytics and routine technical logs must be deleted or deidentified within 180 days of collection unless a shorter applicable period or a specific legal, security, or dispute-preservation need applies. Account-level billing, consent, support, and transaction records are governed separately below. Data attributable solely to a closed account remains subject to the six-month closure ceiling where sooner, absent a justified exception. Deidentified information may be retained only with measures and commitments required to keep it deidentified.

Billing, consent, request, and dispute records. Limited records may be retained beyond account closure as required or reasonably necessary for taxes, accounting, fraud prevention, proof of authorization, privacy- request handling, legal claims, or a valid preservation obligation. They must remain restricted to the justified purpose and be deleted when no longer necessary.

Backups and supplier copies. The deletion process must include controllable backups and instructions to contracted suppliers, within the applicable period and subject to legitimate legal exceptions. Restoring a backup must not defeat a valid deletion. Public blockchain records and information independently retained by authorized external recipients may not be erasable by us; that does not excuse deletion of copies we control or required instructions to service providers.

Six months is an ordinary account-closure ceiling, not a minimum retention period. A statutory deletion or other privacy request may require action sooner. Closing an organizational account does not authorize destruction of another customer's independently owned account information.

10. Security and processing locations

We use reasonable safeguards appropriate to the information and applicable obligations. No internet service, AI workflow, storage system, or supplier is completely secure. dectec and authorized personnel or suppliers may access information for the operational purposes and permissions described above. Customer-controlled credentials, devices, sharing instructions, and backups also affect protection.

This Policy does not promise end-to-end encryption for every operation, exclusive user decryption, zero staff access, continuous availability, or recovery of all lost data. We will provide incident notices and take other steps where applicable law requires them. A user's upload restriction or acceptance of risk does not waive non-waivable duties.

U.S.-only participation does not establish U.S.-only data residency. Information may be processed in the United States or other countries where authorized service providers or personnel perform the stated functions. Such processing remains subject to this Policy and applicable contractual and legal protections; foreign legal requirements may differ from U.S. requirements. We do not promise a particular data-residency arrangement unless a signed agreement expressly provides one. Processing-location and provider information applicable to your Service may be requested through Appendix A before supplying information or connecting an account.

11. Your choices and request process

Depending on your residence, our role, and applicable law, you may have rights to confirm processing; access information and obtain a portable copy; correct inaccuracies; delete information; opt out of covered sale, sharing, targeted advertising, or certain profiling; limit or consent to certain sensitive-information uses; appeal a denied request; and use an authorized agent. We do not unlawfully discriminate or retaliate for exercising a protected right.

Submit privacy requests using the email address in Appendix A — Contact & Resources. Identify the right you wish to exercise and provide enough information to locate the relevant account or matter. A suggested subject is "Privacy Request," but no prescribed wording is required. Do not submit passwords, raw API keys, or identity documents in the request. You do not have to create a new account where law prohibits that requirement. This email is our designated contact; any additional request method required by applicable law must also be made available, and no provision here waives such a requirement.

We use proportionate verification appropriate to the request and risk. We may ask for information already associated with the account and evidence of an agent's authority. Do not send raw passwords, API keys, seed phrases, or sensitive identification documents through an ordinary request channel. An opt-out that does not legally require identity verification will not be conditioned on unnecessary verification.

We will acknowledge and respond within applicable legal periods and explain any permitted extension, denial, or partial fulfillment. We may need to preserve limited information under a legal exception or protect another person's rights. If an appeal right applies, use the email address in Appendix A, identify the original request, and explain the disagreement; "Privacy Appeal" is a suggested subject. We will provide the required response and information about further recourse. You may independently contact the relevant regulator or state attorney general; contacting dectec is not a prerequisite to a lawful regulator complaint. When an organization controls processing of its own content, we may direct the request to that organization or assist it as required by our role. That does not displace rights concerning information for which dectec is independently responsible.

You can withdraw an optional consent, change supported permissions, or revoke a connected account prospectively. Use Appendix A for assistance and revoke provider credentials directly where necessary. This does not undo lawful earlier processing or irreversible transmissions. To stop marketing communications, use the email address in Appendix A; any legally required unsubscribe mechanism in a message also remains available. Necessary account, security, and legal communications may continue. Subscription cancellation and account closure are separate from a marketing opt-out.

12. Nevada residents

Nevada residents may submit a verified request directing an operator not to sell covered information as Nevada law defines a sale. Use the designated email address in Appendix A and identify the Nevada sale opt-out. This right can be exercised even when a sale is not presently planned.

For an applicable Nevada request, we will respond within 60 days, subject to a legally permitted extension of up to 30 additional days with notice. A different applicable law may require faster action. Nevada's sale definition is not identical to California's sale/sharing definitions. Our applicable sale, sharing, and targeted- advertising practices are described in Section 8.

Contact us to review or request changes to covered personal information through Section 11. Material privacy-practice changes will be communicated as described in Section 14. Non-waivable Nevada security and privacy protections remain applicable despite any limitation of liability in the Terms.

13. California and other U.S. state disclosures

13.1 Applicability. Where the California Consumer Privacy Act, as amended (CCPA), applies to dectec and the processing concerned, California residents may exercise the rights described here. Other state rights apply according to their own scope, exemptions, and effective requirements. An adult business contact or employee is not automatically outside privacy protections simply because the account is organizational.

13.2 California categories and purposes. The following is the category mapping for the services described in this Policy. Sections 2, 4, 6, and 9 identify sources, purposes, recipient categories, and retention criteria. Sensitive uploads are prohibited, but information actually received or generated must still be assessed accurately.

Category and disclosure summary. The table above identifies the information categories involved in the Services described by this Policy. Those categories may be processed by the functional provider categories in Section 6 as needed for hosting, storage, AI, support, security, analytics, communications, and payment administration. Authorized recipients and managed-account administrators receive only information within their permitted role or instructions. This Policy does not authorize sales or advertising-related sharing, as described in Section 8. To request the information collected about you and the relevant sources, purposes, disclosures, and recipients for the preceding 12 months or any longer period required by law, use the email address in Appendix A. A category appearing in the table does not mean that every type of information is collected from every person.

13.3 California rights and timing. Subject to applicable exceptions, you may request access and information about collection, use and disclosure; correction; deletion; portability; opt-out of sale or sharing; and limitation of sensitive-information uses where applicable. Use Section 11's designated methods. We generally acknowledge access, correction, and deletion requests within 10 business days and respond within 45 calendar days, with one permitted additional 45-day extension on notice. Applicable sale/sharing opt-outs and sensitive-use limitation requests are handled as soon as feasible within the required period, not through the six-month closure schedule.

13.4 Choices and agents. Use the email address in Appendix A for applicable privacy choices and opt- outs. Legally recognized preference signals must also be honored where required. An authorized agent may act with appropriate authority. Reasonable verification may apply to access, correction, and deletion, but not as a pretext to obstruct a legally valid opt-out. Applicable non-retaliation rights, remedies, and statutory limitations remain intact.

13.5 Incentives, profiling, and additional rights. A future program offering compensation for personal information requires its own notice, material terms, and any required opt-in or withdrawal mechanism. Where applicable law requires additional notices or choices for automated significant decisions or profiling, those must be provided for the relevant feature. For other qualifying U.S. state requests, we apply that state's rights, deadlines, appeal procedures, and required preference-signal treatment rather than assuming California's process is universal.

14. Policy changes

We may update this Policy as service practices and legal requirements change. We will identify the effective date and give appropriate notice of material changes through the Service, account contact, or another suitable method. Where fresh consent is legally required, we will obtain it before the new activity. A posted update or continued use is not retroactive permission for an incompatible undisclosed use of previously collected information.

Privacy requests and choices already in effect remain subject to applicable law. A change in ownership or supplier does not automatically cancel them. We will update this Policy to reflect material changes in our practices and honor applicable privacy commitments made during signup, sales, and product use.

15. Contact us

Appendix A — Contact & Resources contains our designated email address for privacy rights, access, correction, deletion, appeals, tracking and recording choices, marketing opt-outs, provider information, billing, support and account closure. Suggested subjects help route a request, but special wording is not required. A separate contact-page address is not required to email us.

Include only information needed to identify the account or issue. Do not include passwords, API secrets, wallet seed phrases, prohibited sensitive documents or unnecessary third-party information. Our affiliation is described as "dectec, an AiFi company"; it does not, without an actual processing role, make an affiliate the recipient of all your information. Mandatory privacy-request and legal-process requirements remain unaffected by the designated email channel.

Appendix A — Contact & Resources

Use this email address for all service inquiries, notices, privacy choices and resource requests. The subjects below are suggestions only; a valid request does not require special wording.

Ready-to-send cancellation email

Email a cancellation request

Message: Please cancel automatic renewal of all dectec subscriptions associated with this sending account email address, effective when received, and confirm by email.

What to include

Describe the request and identify the account or relevant item if it cannot be identified from your email. For an appeal, identify the original request. For arbitration opt-out, follow the 30-day period and content requirements in Terms Section 21. Do not send passwords, API secrets, seed phrases or unnecessary sensitive content.

Available resources

Request copies of the Terms, Privacy Policy, applicable purchase or points-program terms, payment disclosures, provider and processing information, voice/avatar disclosures, tracking information, and applicable AAA rules and filing instructions. Resource requests do not replace disclosures required before purchase or processing, and do not delay the exercise of a legal right.

Keeping this directory current

Contact routes and resource references may be updated for accuracy. An update to this directory does not by itself change fees, liability limits, consent, retention, dispute rights or other substantive terms; those changes follow the applicable document’s change procedures. Required notices, in-service controls and legal-process methods remain available as required by law.