Effective Date: July 11, 2026 | Last Updated: July 11, 2026

1. Introduction

Aram Inc.("we," "us," or "our") operates Holden Concierge(the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect personal information about you when you use the Platform. It also describes your rights regarding your personal data.

By using the Platform, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly when you:

• Create an account: name, email address, job title, company name, and password
• Complete your profile: industry, department, brand preferences, and communication preferences
• Use the concierge: the content of your conversations, product requests, event details, and any other information you share in chat
• Place or manage orders: shipping addresses, artwork files, decoration specifications, and approval decisions
• Submit artwork or brand assets: logos, images, color values, and brand guidelines
• Contact support: any information you include in support requests or feedback submissions

2.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical information, including:

• Device and browser information: IP address, browser type and version, operating system, device identifiers
• Usage data: pages visited, features used, links clicked, time spent on the Platform, and navigation paths
• Session data: login timestamps, session duration, and authentication events
• Cookie and similar tracking data: see Section 7 below

2.3 Information from Your Organization

If you access the Platform through an enterprise account, your organization may provide us with information about you, including your name, email address, role, team, and budget allocation. Your organization's administrators may also be able to view your activity and purchase history within the Platform.

2.4 Information from Third Parties

We may receive information about you from third-party services integrated with the Platform, such as single sign-on (SSO) providers, product data suppliers, or your organization's existing CRM or procurement systems. We use this information only to provide the services you or your organization have requested.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Platform and its features
• Process and fulfill orders and communicate about order status
• Power the AI concierge to generate personalized product recommendations and responses
• Maintain your account, inquiry history, and saved ideas
• Enable enterprise features such as budget tracking, brand governance, and approval workflows
• Send transactional communications such as order confirmations, proof approvals, and delivery notifications
• Send proactive communications about upcoming events, budget milestones, or product opportunities, subject to your notification preferences
• Respond to your support requests and feedback
• Monitor Platform security, detect fraud, and prevent abuse
• Comply with our legal obligations
• Analyze usage patterns to understand how the Platform is used and how to improve it

4. AI Processing and Third-Party AI Services

The Platform uses artificial intelligence to power the concierge chat, product recommendations, and content enrichment features. This section explains how your data is used in connection with AI.

4.1 How AI Processes Your Data

When you use the concierge or other AI-powered features, your messages and relevant context (such as your order history and preferences) are sent to an AI model to generate a response. The AI uses this information solely to produce a relevant reply. It does not store your personal data beyond what is needed to complete the interaction.

4.2 Anthropic

The AI concierge is powered by Claude, a large language model developed by Anthropic, PBC. When you send a message through the concierge, the content of that message is transmitted to Anthropic's API for processing. Anthropic processes this data as a service provider on our behalf and is subject to data processing obligations consistent with applicable privacy law. Anthropic's privacy practices are described at anthropic.com/privacy.

4.3 What We Do Not Do

• We do not use your personal conversation data to train AI models without your explicit consent.
• We do not sell your conversation data to third parties.
• We do not use your data to build profiles for advertising targeting purposes.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Service Providers

We share information with third-party vendors and service providers who assist us in operating the Platform, including cloud hosting providers, email delivery services, AI model providers, payment processors, and customer support tools. These providers are contractually required to use your information only to perform services on our behalf and to maintain appropriate security measures.

5.2 Suppliers and Fulfillment Partners

To fulfill orders, we share relevant order details (shipping address, artwork, decoration specifications) with the promotional product suppliers responsible for producing your order. Suppliers receive only the information necessary to fulfill your specific order.

5.3 Your Organization

If you access the Platform through an enterprise account, your activity, orders, and budget usage may be visible to your organization's authorized administrators as described in Section 2.3.

5.4 Legal Requirements

We may disclose your information if required to do so by law or in good faith belief that such disclosure is necessary to comply with a legal obligation, protect our rights or property, prevent fraud, or protect the safety of our users or the public.

5.5 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

5.6 With Your Consent

We may share your information in other circumstances with your explicit consent.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Platform. Specifically:

• Account information is retained for the duration of your account and for a reasonable period afterward to comply with legal obligations and resolve disputes.
• Order history and related records are retained for a minimum of seven (7) years for tax, audit, and legal compliance purposes.
• Conversation and inquiry data is retained for the duration of your account to enable inquiry history and personalization features. You may request deletion of specific conversations, see Section 8.
• Artwork and brand assets are retained for the duration of your account or until you delete them.
• Usage and technical data is typically retained for up to 24 months in identifiable form, then aggregated or deleted.

When we no longer need your personal information, we securely delete or anonymize it.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform, maintain your session, remember your preferences, and understand how the Platform is used. The types of cookies we use include:

• Strictly necessary cookies: required for the Platform to function. These cannot be disabled.
• Functional cookies: remember your preferences such as language, notification settings, and display options.
• Analytics cookies: help us understand how users interact with the Platform so we can improve it. These are aggregate and do not identify you personally.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Platform. We do not use advertising or third-party tracking cookies.

8. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access: request a copy of the personal information we hold about you
• Correction: request that we correct inaccurate or incomplete information
• Deletion: request that we delete your personal information, subject to legal retention requirements
• Portability: request a machine-readable copy of your data in certain circumstances
• Objection: object to certain uses of your information, including direct marketing
• Restriction: request that we restrict processing of your information in certain circumstances
• Opt-out of AI processing: contact us to discuss options for limiting AI processing of your data, where technically feasible

To exercise any of these rights, contact us at scout@holdenbrand.com. We will respond to verifiable requests within the timeframe required by applicable law (typically 30 to 45 days). We may need to verify your identity before processing a request.

8.1 California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose about you, the right to delete your personal information (subject to exceptions), and the right to opt out of the sale of personal information. We do not sell personal information. You may designate an authorized agent to make a request on your behalf. We will not discriminate against you for exercising your rights.

8.2 Notification Preferences

You may manage your notification and communication preferences through your account settings. You may opt out of non-transactional communications at any time. Note that opting out of transactional emails (such as order confirmations and proof approvals) may affect your ability to manage orders effectively.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, alteration, or disclosure. These measures include encryption in transit and at rest, access controls, regular security assessments, and incident response procedures.

No method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you as required by applicable law.

10. Children's Privacy

The Platform is not directed to children under the age of 16 and we do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child under 16, please contact us immediately and we will take steps to delete such information.

11. International Data Transfers

The Platform is operated in the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Platform, you consent to this transfer. We take appropriate steps to ensure that transfers of personal data are subject to adequate protections as required by applicable law.

12. Links to Other Sites

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the Platform, and we will update the "Last Updated" date at the top of this policy. Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Aram Inc., Privacy Team
5646 Milton Street, Suite 675
Dallas, TX 75206
Email: scout@holdenbrand.com
Website: holdenbrand.com