Privacy Notice

Effective Date: May 28, 2026

Notice Version: 3.0

Data Controller Contact Information

aiAvenu, Inc. (formerly ExtraHourz, Inc.)

admin@avenu.ai

1395 Brickell Ave., Suite 2706

Miami, FL 33131

Website: www.avenu.ai

Introduction

Avenu is a software platform owned by aiAvenu, Inc. (formerly ExtraHourz, Inc.) (“aiAvenu” or “ExtraHourz”), which provides recruiting products and services (the “Services”) to businesses and their representatives. aiAvenu, ExtraHourz, and Avenu are collectively referred to herein as the “Company.”

This privacy notice (this “Policy”) applies to the information that the Company (“aiAvenu,” “ExtraHourz,” “Avenu,” “we,” “us,” or “our”) collect from you, whether in-person or online through our web pages, http://www.avenu.ai, our mobile application (collectively, “Platform”), and through all products, services, communications, and offerings provided (“Services”).

Our privacy notice tells you and other people (the “Users”) what personal data and nonpersonal data we may collect from you, how we collect them, how we protect them, how we share them, how you can access and change them, and how you can limit our sharing of them. Our Privacy Policy also explains certain legal rights that you have with respect to your personal data. Any capitalized terms not defined herein will have the same meaning as where they are defined elsewhere on our Platform.

Scope

Definitions

NONPERSONAL DATA (NPD) is information that is in no way personally identifiable.

PERSONAL DATA (PD) means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. PD is in many ways the same as Personally Identifiable Information (PII). However, PD is broader in scope and covers more data.

GDPR means General Data Protection Regulation (EU) 2016/679.

AI TOOL means any artificial intelligence, machine learning, or automated processing system used by the Company to analyze, score, evaluate, or otherwise process data in connection with the Services, including the Eva AI interviewing platform.

Topics Covered Under the Privacy Policy

• YOUR RIGHTS

• INFORMATION WE COLLECT

• HOW WE COLLECT INFORMATION

• HOW YOUR INFORMATION IS USED AND SHARED, RETAINED, AND UPDATED • REVOKING YOUR CONSENT FOR USING YOUR PD

• PROTECTING THE PRIVACY RIGHTS OF THIRD PARTIES

• DO NOT TRACK SETTINGS

• LINKS TO OTHER WEBSITES

• INTEGRATING SOCIAL NETWORK SERVICES

• PROTECTING CHILDREN’S PRIVACY

• OUR EMAIL POLICY

• OUR SECURITY POLICY

• USE OF YOUR CREDIT CARD

• TRANSFERRING PD FROM THE EUROPEAN UNION; RIGHTS UNDER GDPR • RIGHTS OF CALIFORNIA RESIDENTS UNDER CCPA

• PRIVACY REQUESTS AND CHOICES

• CHANGES TO OUR PRIVACY NOTICE

• CUSTOMER-DIRECTED THIRD-PARTY INTEGRATIONS — NEW • ARTIFICIAL INTELLIGENCE (AI) TOOLS AND AUTOMATED PROCESSING DISCLOSURES — NEW

1. YOUR RIGHTS

You have the right to request that we do not sell any of your personal information. Personal information for this section means a natural person’s first name or first initial and last name in combination with any one or more of the following data elements when the name and data elements are not encrypted: social security number, driver’s license number, driver authorization card number, or identification card number. Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to the person’s financial account. A medical identification number or a health insurance identification number. A username, unique identifier, or electronic mail address in combination with a password, access code, or security question and answer that would permit access to an online account.

If you wish to make this request, please email us at: info@avenu.ai telling us that you do not want to have any of your personal information sold. We will respond to your request within 60 days after receiving it. See Section 14 regarding your rights under GDPR and Section 15 for your rights under the CCPA.

2. INFORMATION WE COLLECT

a. Information We Collect From the Platform and The Services

Generally, you control the amount and type of information that you provide to us when using our Platform and the Services. For us to identify and serve you with the most relevant tools, content, and connections, we and our service providers collect and receive several categories of PD based on the nature of your interactions with us.

b. Commercial and Preference Information

When you register as a user, member, or when buying our products or services, we may collect some or all of the following information: your first and last name, email address, work availability, locations, phone number, physical address, job experience, gender, ethnicity, age, legal status in the United States, payment information, profile URL, username, password, and other relevant information.

c. Employment-Related Information

You may choose to provide information on your profile on the Platform, such as your work experience, employment history, education background, honors, training, the URL to your own profile page, salary expectations and other information.

d. AI Interview Data

If you participate in an AI-powered interview conducted through the Platform (including through our Eva AI interviewing tool), we or our customers may collect audio recordings, video recordings (where applicable), transcripts, and AI-generated assessments of your interview responses. See Section 19 for full disclosures regarding AI processing.

e. Calendar Availability

A User may connect their calendar with Avenu. Our calendar integration only checks the duration and free/busy status of the events in your calendar. We never store details about the appointments in your connected calendar. Avenu’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. HOW WE COLLECT YOUR INFORMATION

You have the right to request that we do not sell any of your personal information. If you wish to make this request, please email us at: info@avenu.ai. We will respond to your request within 60 days after receiving it.

a. Automatic Information

We automatically receive information from your web browser or mobile device. This information may include the name of the website from which you entered our Platform, your IP address, Internet service provider’s name, web browser type, type of mobile device, computer operating system, and data about your browsing activity.

b. Our Use of Cookies

Our Platform uses cookies. When you enter and use our Platform and agree to accept cookies, some of these cookies may contain your PD. You may control cookies through your browser settings. Cookie types used include: Strictly Necessary Cookies, Performance Cookies, Functional Cookies, Media Cookies, Advertising or Targeting Cookies, Session Cookies, and Persistent Cookies.

c. Web Beacons

We may also use a technology called web beacons to collect general information about your use of our Platform and your use of special promotions or newsletters.

d. Collecting Information About Your Physical Location

When you use our Platform, we may collect and process information about your actual physical location using technologies such as GPS and IP tracking.

e. Cross Device Tracking

We use a service that tracks your behavior from device to device to analyze traffic behavior and improve our marketing and advertising.

f. Chat Software and Contact Forms

Our Platform contains chat software or contact forms that enable visitors to communicate with us. When you use these tools, we may collect your email address, first name, last name, location, and other information you choose to provide.

g. Analytics

We use analytics services including Google Analytics to collect information about the use of our Platform, including visit frequency, pages visited, traffic sources, and IP addresses.

4. HOW YOUR INFORMATION IS USED, SHARED, RETAINED, AND UPDATED a. Purpose of the Use of the Information

We may use information we collect for the following purposes:

• Provide our products and services you have requested or purchased.

• Personalize and customize our content.

• Process and fulfill transactions and services requested by you.

• Make improvements to our Platform and Services.

• Measure the performance of jobs and ads served by our Platform.

• Aggregate or anonymize data to create statistics that do not identify any customers or individuals.

• Process your job application, including scheduling and conducting interviews, reviewing and verifying information, extending offers, and maintaining applicant data for future consideration.

• Contact you with updates to our Platform, products, and services.

• Resolve problems and disputes.

• Protect the security of our Platform and prevent fraud and illegal activities.

• Enforce the Privacy Policy, Terms of Use, and other policies.

• For marketing, advertising and promotional purposes.

• To comply with legal obligations and for general business operations.

• For health and safety purposes.

• As otherwise permitted or required by law.

b. Communications and Emails

When we communicate with you, we will use the email address you provided when you registered. We may send you emails with promotional information unless you have opted out.

c. Sharing Information with Affiliates and Other Third Parties

We do not sell or rent your PD to third parties for marketing purposes. However, for data aggregation purposes we may use your NPD, which might be sold to other parties at our discretion. Any such data aggregation would not contain any of your PD. We may give your PD to third-party service providers whom we hire to provide services to us, including payment processors, web analytics companies, advertising networks, call centers, data management services, help desk providers, accountants, law firms, auditors, and email service providers.

d. Sharing Your PD With Other Users

Some of your user personal information may be displayed to other users to help user interaction within our Platform or address your request for our services. You understand that any content you upload to your public user profile, including PD, or content that you disclose online in a way that other users can see becomes publicly accessible.

e. Sharing Information When You Login Using Social Media Websites We may share your information with third parties such as Facebook, Twitter, YouTube, Instagram, and Google if you decide to login to our Platform using these third parties.

f. Sharing Information With Business Partners

We may share your PD with our business partners, affiliates, and joint venture partners so that they can send you information about our products and services.

g. Text Messaging and Push Notifications

If you provide a mobile telephone number to us, you are giving your consent and authorization to us or a third party to send you text messages and push notifications. You can stop receiving these at any time by contacting us.

h. Legally Required Releases of Information

We may be legally required to disclose your PD if such disclosure is required by subpoena, law, or other legal process; necessary to assist law enforcement; necessary to investigate violations of our terms and conditions; or necessary to protect our legal rights.

i. Disclosures to Successors

If our business is sold or merges with another business, we retain the right to transfer your PD to the new business, which would retain the right to use your PD according to the terms of this privacy notice.

j. Retaining and Destroying Your PD

We retain information that we collect from you only for as long as we need it for legal, business, or tax purposes. When your information is no longer needed, we will destroy, delete, or erase it.

k. Updating Your PD

You can update your PD using services found on our Platform, or by contacting us using the contact information found at the top of this privacy notice.

5. REVOKING YOUR CONSENT FOR USING YOUR PD

You have the right to revoke your consent for us to use your PD at any time. Such opt-out will not affect disclosures otherwise permitted by law including but not limited to: (i) disclosures to affiliates and business partners; (ii) disclosures to third-party service providers; (iii) disclosures to third parties as necessary to fulfill your requests; (iv) disclosures to governmental agencies or law enforcement; (v) previously completed disclosures to third parties; or (vi) disclosures to third parties in connection with subsequent contests or promotions. If you want to revoke your consent, please contact us using the contact information at the top of this privacy notice.

6. PROTECTING THE PRIVACY RIGHTS OF THIRD PARTIES

If any postings you make on our Platform contain information about third parties, you agree to make sure that you have permission to include that information. While we are not legally liable for the actions of our users, we will remove any postings about which we are notified, if such postings violate the privacy rights of others.

7. DO NOT TRACK SETTINGS

Some web browsers have settings that enable you to request that we do not track your movement within our Platform. Our Platform does not obey such settings when transmitted to and detected by our Platform. You can turn off tracking features and other security settings in your browser by referring to your browser’s user manual.

8. LINKS TO OTHER WEBSITES

Our Platform may contain links to other websites. These websites are not under our control and are not subject to our privacy notice. We have no responsibility for these websites, and we provide links solely for your convenience. You acknowledge that your use of and access to these websites are solely at your risk.

9. PROTECTING CHILDREN’S PRIVACY

Even though our Platform is not designed for use by anyone under the age of 16, we do not knowingly collect PD from children under the age of 16. If you are a parent or guardian and believe that your child is using our Platform, please contact us. If we discover that a child is accessing our Platform, we will delete his/her information within a reasonable period.

‍

10. OUR EMAIL POLICY

You can always opt out of receiving email correspondence from us or our affiliates. We will not sell, rent, or trade your email address to any unaffiliated third party without your permission except in the sale or transfer of our business.

11. OUR SMS MESSAGE POLICY

You can opt out of receiving text messages from us by texting “STOP” in response to any text message or by sending an email to info@avenu.ai with “SMS unsubscribe” in the subject line.

12. OUR SECURITY POLICY

We have built our Platform using industry-standard security measures and authentication tools to protect the security of your PD. aiAvenu maintains SOC 2 Type II certification, demonstrating our commitment to security, availability, processing integrity, confidentiality, and privacy. We and the third parties who provide services to us also maintain technical and physical safeguards to protect your PD. Unfortunately, we cannot guarantee prevention of loss or misuse of your PD or secure data transmission over the Internet because of its nature. We strongly urge you to protect any password you may have for our Platform and not share it with anyone.

13. USE OF YOUR CREDIT CARD

You may have to provide a credit card to buy products and services from our Platform. We use third-party billing services and have no control over them. We use commercially reasonable efforts to ensure that your credit card number is kept strictly confidential by using only third-party billing services that use industry-standard encryption technology.

14. TRANSFERRING PD FROM THE EUROPEAN UNION; RIGHTS UNDER GDPR

PD that we collect from you may be stored, processed, and transferred among any countries in which we operate. Our company relies on derogations for specific situations as defined in Article 49 of the GDPR. If you are a European Union customer or user, with your consent your PD may be transferred to the United States or other countries outside the European Union when you request information from us.

YOUR RIGHTS UNDER THE GDPR

When using our Platform and submitting PD to us, you may have certain rights under the GDPR if you reside in any of the countries of the European Union:

• The Right to Be Informed — You have the right to be informed about the PD that we collect from you and how we process them.

• The Right of Access — You have the right to get confirmation that your PD are being processed and to access your PD.

• The Right to Rectification — You have the right to have your PD corrected if they are inaccurate or incomplete.

• The Right to Erasure (Right to Be Forgotten) — You have the right to request the removal or deletion of your PD if there is no compelling reason for us to continue processing them.

• The Right to Restrict Processing — You have the right to block or restrict the processing of your PD.

• The Right to Data Portability — You have the right to request your PD that you provided to us and use them for your own purposes. We will provide your data to you within 30 days of your request.

• The Right to Object — You have the right to object to us processing your PD for direct marketing, legitimate interests, or automated decision-making including profiling. • Automated Individual Decision-Making and Profiling — You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects regarding you or similarly significantly affects you. See also Section 19.

• Filing a Complaint with Authorities — You have the right to file a complaint with supervisory authorities if your information has not been processed in compliance with the GDPR.

15. YOUR RIGHTS UNDER THE CCPA

California Civil Code Section 1789.83, also known as the “Shine the Light” law, permits California residents to request and obtain from businesses a list of what personal information (if any) was disclosed to third parties for direct marketing purposes in the preceding calendar year. Under Section 1798.83, we currently do not share your personal information with third parties for direct marketing purposes.

As a Business under the CCPA, we notify and provide California residents with the following rights with respect to their PD:

• To opt out of the sale or sharing of PD, if any.

• To limit certain uses or disclosures of sensitive personal information.

• To request deletion of their PD that we have collected (without charge), subject to certain exceptions.

• To request the correction of inaccurate PD.

• To confirm whether we are processing your PD and to access such PD in a portable and, to the extent technically feasible, readily usable format.

• Right to non-discrimination: the right not to be subject to discriminatory treatment for exercising rights under the CCPA.

• Right to opt out of automated decision-making technology, including profiling. See Section 19(e) for details.

We may collect limited “Sensitive Personal Information” (as defined by the CCPA) including: (a) Social Security number and other government identifiers; (b) driver’s license, state identification card, or passport number; (c) precise geolocation; (d) health and disability information. We do not sell or share Sensitive Personal Information.

16. PRIVACY REQUESTS AND CHOICES

aiAvenu and its subsidiaries including Avenu currently do not sell your information. We will not discriminate against you for exercising any of the above rights. You can exercise your rights by contacting us using the information at the top of this privacy notice.

To exercise applicable rights to know/access, correct, or delete, please submit a request by: (i) emailing info@avenu.ai with the subject line “California Privacy Request”; or (ii) contacting us via postal mail at the address listed at the top of this notice.

Do Not Sell or Share My Personal Information: To opt out of the Company’s sale or sharing of your PD, visit the “Your Privacy Choices” link in the footer of the Website or use a Global Privacy Control (“GPC”) enabled browser or plug-in.

17. CHANGES TO OUR PRIVACY NOTICE

We reserve the right to change this privacy notice at any time. If our company decides to change this privacy notice, we will post those changes on our Platform so that our users and customers are always aware of what information we collect, use, and disclose. If at any time we decide to disclose or use your PD in a method different from that specified at the time it was collected, we will provide advance notice by email. In all cases your continued use of our Platform, services, and products after any change to this privacy notice will constitute your acceptance of such change.

NEW PROVISIONS — EFFECTIVE MAY 28, 2026

18. CUSTOMER-DIRECTED THIRD-PARTY INTEGRATIONS

aiAvenu offers customers the ability to connect their aiAvenu accounts to third-party platforms, corporate systems, payroll systems, and other external applications via application programming interface (“API”) (each, an “Integration”). This section governs how Personal Data is handled in connection with such Integrations.

a. Overview

When a customer requests or activates an Integration, the customer is directing aiAvenu to transmit specified Personal Data to that third-party platform on their behalf. Integrations may include, without limitation, connections to franchise corporate home office systems, payroll platforms, human resources information systems (HRIS), background check providers, onboarding tools, and other workforce management applications.

b. Customer as Data Controller; aiAvenu as Data Processor

In all Integration scenarios, the customer directing the Integration is the data controller responsible for the Personal Data transferred. aiAvenu acts solely as a data processor and conduit, transmitting data only as instructed by the customer. aiAvenu does not independently decide to transfer Personal Data to third parties via Integrations. The customer’s initiation of an Integration constitutes a documented instruction to aiAvenu to transfer the specified data.

c. Customer Representations and Warranties

By activating an Integration, the customer represents and warrants that:

• They are authorized to share the applicable Personal Data with the designated third-party receiving system;

• They have provided all required notices to, and obtained all required consents from, the individuals whose data will be transferred, under all applicable federal, state, and local laws (including but not limited to applicable employment laws, state privacy statutes, biometric information privacy laws, and any applicable collective bargaining obligations);

• The third-party recipient is authorized to receive, process, and store the transferred data; and

• The Integration and data transfer comply with all applicable laws, including but not limited to the CCPA, applicable state privacy laws, and GDPR where applicable.

d. Scope of Transfer and Data Minimization

aiAvenu transmits only the data fields configured and authorized for the Integration. Customers are responsible for configuring what data is shared and ensuring that the scope of data transferred is appropriate, minimized to what is necessary for the intended purpose, and proportionate. aiAvenu recommends customers review and limit Integration data fields to only those fields required for the specific business purpose.

e. Franchisor and Corporate Home Office Systems

Where a customer is a franchisee of a franchisor network, and the Integration connects to a franchisor-owned or franchisor-controlled platform, the franchisor corporate system is an independent third party for purposes of this Policy. aiAvenu is not a party to any data-sharing obligations between a franchisee and its franchisor, and the franchisor’s use, storage, and further disclosure of data following transfer is governed by the franchisor’s own privacy policies and agreements with the franchisee. aiAvenu makes no representations regarding the data practices of franchisor platforms.

f. Authorization and Consent Mechanism

When a customer initiates an API Integration through the aiAvenu platform, the customer will be presented with a disclosure identifying: (i) the name and nature of the third-party recipient; (ii) the categories of Personal Data to be transmitted; and (iii) the representations and warranties set forth in subsection (c) above. Proceeding with and activating the Integration constitutes the customer’s affirmative instruction and consent to aiAvenu to transmit the described data. aiAvenu will maintain a record of this authorization.

g. Audit and Logging

aiAvenu maintains logs of Integration authorizations, including the date, time, authorizing user identity, data categories authorized for transmission, and the designated third-party recipient. These logs are maintained as part of aiAvenu’s SOC 2 Type II–compliant security, access control, and audit trail practices and are available to customers upon written request consistent with the applicable customer agreement.

h. Third-Party Recipient Responsibility

Once Personal Data is transmitted to a third-party platform at the customer’s direction via Integration, aiAvenu is not responsible for how that third party uses, stores, retains, or further

discloses such data. aiAvenu is not a party to any agreement between the customer and the third party recipient, and the third party’s privacy and security practices are not within aiAvenu’s control. Individuals with questions or requests regarding Personal Data transmitted to a third-party Integration recipient should contact that third party and/or the customer directly.

i. Liability

aiAvenu’s liability for data transferred at a customer’s direction via Integration is limited as set forth in the applicable customer agreement. aiAvenu shall not be liable for any unauthorized use, disclosure, breach, or mishandling of Personal Data by the third-party recipient following transmission, or for any failure by the customer to obtain required consents or provide required notices prior to initiating the Integration.

j. Data Subject Rights for Integrated Data

Individuals (including employees and job candidates) whose Personal Data has been transmitted via an Integration should direct any requests to access, correct, delete, or restrict their data to the customer (data controller) that authorized the Integration. aiAvenu will provide reasonable assistance to customers in responding to such requests as required under applicable law and the applicable customer agreement.

19. ARTIFICIAL INTELLIGENCE (AI) TOOLS AND AUTOMATED PROCESSING DISCLOSURES

aiAvenu’s platform incorporates artificial intelligence and automated processing technologies to assist employers with recruiting, screening, and hiring. This section provides full disclosure of aiAvenu’s use of AI tools and your rights in connection with automated processing.

a. Our AI-Powered Tools

aiAvenu offers an AI-powered interviewing and screening tool called “Eva” (“Eva” or the “AI Interviewing Tool”). Eva conducts real-time conversational interviews with job candidates on behalf of our customers (employers). Eva is capable of conducting interviews in English, Spanish, French Canadian, and German. In addition to Eva, our platform may incorporate other AI-assisted features for candidate scoring, assessment, resume analysis, and workflow automation.

b. Notice of AI-Powered Interviews

If you are a job candidate participating in an interview or screening conducted through our platform using Eva or any other AI tool:

• You will receive advance written notice before any AI-analyzed interview that artificial intelligence will be used to conduct and/or analyze your interview responses. • Proceeding with the interview after receiving such notice constitutes your consent to the use of AI analysis of your interview responses for that application process. • Where the AI tool analyzes voice characteristics, speech patterns, or — in video-enabled deployments — facial expressions, gestures, or other biometric-adjacent characteristics, additional notice will be provided prior to the interview and your consent will be separately confirmed.

• Your AI interview recordings and data will not be shared with third parties other than the employer (our customer) and aiAvenu’s authorized subprocessors, except as required by law or as directed by the employer in accordance with Section 18.

• You may decline to participate in an AI-conducted interview. If you decline, the employer (our customer) is responsible for making alternative arrangements; aiAvenu is not responsible for any employment outcomes resulting from your decision not to participate.

c. Illinois Artificial Intelligence Video Interview Act

If you are a job candidate located in Illinois, aiAvenu and its customers comply with the Illinois Artificial Intelligence Video Interview Act (820 ILCS 42/1 et seq.). In connection with any AI analyzed video interview:

• You will receive advance notice before the interview that an AI may be used to analyze your video interview and information about how the AI works and what general types of characteristics it uses to evaluate candidates.

• Your interview video will not be shared with any third parties other than vendors and contractors necessary to evaluate whether you qualify for the position, except with your consent.

• All copies of your interview video will be deleted within 30 days of your request, subject to any legal hold obligations.

d. Other State AI Interview and Employment Laws

aiAvenu monitors and supports compliance with applicable AI and automated employment decision laws, which vary by jurisdiction and continue to evolve. Customers using aiAvenu’s AI tools are responsible for ensuring their use complies with all applicable laws in the jurisdictions in which they operate, including but not limited to:

• Maryland’s restrictions on the use of facial recognition technology in hiring (Md. Code, Lab. & Empl. §3-717);

• New York City Local Law 144 (Int. 1894-A), which applies only to positions located within the five boroughs of New York City and requires employers and employment agencies using Automated Employment Decision Tools (AEDTs) to screen candidates or employees for such positions to: (i) conduct and publicly post an independent bias audit of the AEDT prior to use; and (ii) provide advance written notice to candidates and employees that an AEDT will be used to evaluate them. This law does not apply to positions located elsewhere in New York State or in other jurisdictions; and

• Any other applicable state or local AI, biometric, or automated hiring laws. Customers using Eva or other aiAvenu AI tools in jurisdictions with specific AI hiring laws are responsible for conducting any required bias audits, providing required notices, and maintaining required records. aiAvenu will provide reasonable cooperation and documentation to assist customers in meeting these obligations.

e. Automated Decision-Making; Human Review

Our platform may use automated processing to generate candidate scores, assessments, summaries, or rankings based on interview responses, application data, and other inputs. These automated outputs are provided to our customers (employers) as tools to assist in — not replace — human hiring decisions.

aiAvenu’s position is that our AI tools are decision-support tools. The final hiring decision is always made by the employer (our customer) and involves human review. Our customers, as employers and data controllers, bear responsibility for all final hiring decisions and must not rely solely on automated processing in making employment decisions affecting candidates.

Candidates who have been subject to AI-assisted evaluation and who wish to request that a human review be conducted, or to understand the basis on which an automated assessment was made, should contact the employer (our customer) that conducted the interview process.

f. GDPR Article 22 — Automated Decision-Making Rights

If you are located in the European Union or European Economic Area, you have the right under Article 22 of the GDPR not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right is subject to exceptions where automated processing is necessary for entering into a contract, authorized by law, or based on your explicit consent.

To exercise your Article 22 rights, or to request a human review of any automated assessment, please contact us at info@avenu.ai or contact the employer (our customer) that initiated your interview process.

g. CCPA / CPRA Automated Decision-Making Rights

California residents have the right under the CCPA / CPRA to opt out of automated decision making technology, including profiling, that produces legal or similarly significant effects in connection with employment decisions. This includes the right to:

• Opt out of automated processing that evaluates your characteristics for employment decisions;

• Request human review of any decision made using automated processing; and • Receive an explanation of how the automated process works and what factors were considered.

To exercise these rights, please contact us at info@avenu.ai with the subject line “Automated Decision-Making Opt-Out,” or contact the employer (our customer) directly.

h. Data Collected and Processed by AI Tools

In connection with AI-powered interview and screening tools, the following categories of data may be collected and processed:

• Audio recordings of interview responses

• Video recordings (where the employer enables video functionality)

• Transcripts of interview responses

• AI-generated scores, assessments, rankings, and summaries

• Linguistic patterns and communication characteristics derived from responses • Metadata related to the interview session (duration, language, timestamp)

This data is collected on behalf of and made available to the employer (our customer) as data controller. aiAvenu processes this data as a data processor pursuant to its agreement with the customer.

i. Retention and Deletion of AI Interview Data

AI-generated interview data, including recordings, transcripts, and scores, is retained in accordance with the applicable customer agreement, aiAvenu’s data retention policies, and applicable law. Retention periods vary by customer configuration.

Candidates may request deletion of their AI-generated interview data by: (i) contacting the employer (data controller) that conducted the interview process directly; or (ii) submitting a deletion request to aiAvenu at info@avenu.ai. aiAvenu will process deletion requests consistent with its obligations as a data processor and applicable law. Illinois candidates are entitled to deletion within 30 days of request as required by the Illinois AI Video Interview Act.

j. Bias, Fairness, and Responsible AI

aiAvenu is committed to the responsible development and deployment of AI tools in the hiring process. Our AI tools are designed, tested, and evaluated with the goal of minimizing bias and promoting fair, equitable outcomes across protected characteristics. aiAvenu regularly reviews its AI tools for accuracy and potential disparate impact.

Where required by applicable law, customers are responsible for ensuring that required independent bias audits of automated employment decision tools are conducted prior to use and that audit results and required candidate notices are published and delivered. For example, NYC Local Law 144 applies specifically to positions located within New York City (the five boroughs only) and does not extend to other parts of New York State or to any other jurisdiction. Customers filling positions in New York City must ensure compliance with Local Law 144 independently of any obligations in other jurisdictions. aiAvenu will provide reasonable technical documentation and cooperation to facilitate required audits.

k. Candidate Transparency and Explainability

Upon request, candidates may ask the employer (our customer) for an explanation of how the AI tool evaluated their interview responses, including the general categories of characteristics or factors assessed. aiAvenu supports customers in providing reasonable candidate transparency, consistent with aiAvenu’s proprietary technology protections and applicable law.

l. No Use of Sensitive Personal Information for AI Training Beyond Authorized Purposes aiAvenu does not use Sensitive Personal Information (as defined under applicable law, including the CCPA) collected through the Platform to train AI models beyond the purposes authorized by law and described in this Policy. aiAvenu does not use candidate interview data to train its AI models without appropriate authorization from the data controller (employer) and, where required, the candidate.

m. Multi-Language Support

Our Eva AI interviewing tool supports interviews in English, Spanish, French Canadian, and German. Candidates requesting an interview in a supported language should notify the employer, who can configure Eva accordingly. aiAvenu’s AI assessment models are validated for use across all supported languages to promote consistency and fairness.

‍