Privacy Policy | Alumbra AI

Alumbra Solutions LLC

Last Updated: May 13, 2026

Alumbra Solutions LLC ("Alumbra," "we," "us," or "our"), a North Carolina limited liability company with offices at 101 S Tryon Street, Suite 2700, Charlotte, NC 28280, respects your privacy. This Privacy Policy (the "Policy") explains how we collect, use, disclose, and safeguard personal information when you use our websites, mobile and desktop applications, APIs, and related products and services (collectively, the "Services"), including our text-message and WhatsApp-based scam prevention product, Inkling ("Inkling"), and our AI upskilling platform, Alumbra Relevant ("Alumbra Relevant").

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Services.

1. SCOPE OF THIS POLICY

This Policy applies to personal information we collect from or about individuals who interact with the Services. It does not apply to information collected by any third party, including any third-party website, application, or service that you access through the Services or that you connect to the Services. We encourage you to review the privacy policies of any third parties before providing them with personal information.

The Services are intended for users located in the United States. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local laws.

2. INFORMATION WE COLLECT

We collect the categories of personal information described below. The specific information we collect depends on how you interact with the Services.

2.1 Information You Provide Directly

• Account Information. When you create an account on Alumbra Relevant, we collect your name, email address, password (stored in hashed form), profile picture, and account preferences. When you activate Inkling using a short code and passcode provided by your financial institution, we collect your mobile phone number or WhatsApp identifier, the issuing financial institution's identifier, and timestamps associated with your activation.

• Payment Information. When you purchase a paid subscription or feature, we collect billing details necessary to process your payment, including your name, billing address, and the last four digits of your payment card. Full payment card numbers and related financial credentials are collected and processed directly by our third-party payment processor (such as Stripe) and are not stored on our systems.

• Messages You Submit to Inkling. To analyze potential scams, you may submit text messages, WhatsApp messages, or screenshots of suspicious messages to Inkling. When you submit content, our systems automatically remove personal information (such as names, account numbers, email addresses, and other personally identifiable information) from the content before our analysis systems process it. We do not retain or use the personal information that is removed from your submissions; only the de-identified content of the submission is used to generate your scam analysis, and only aggregated, de-identified data is retained for service improvement purposes. You should only submit messages or screenshots that you are authorized to share with us.

• Scam Reporting Portal Activity. The Inkling provides a link to a web portal where you may report suspected scams in greater detail and access educational resources. When you use the portal, we collect the information you choose to submit through the reporting forms (which should not include unnecessary personal information about you or third parties) and information about your interactions with the educational content.

• AI Agent Inputs and Configurations. When you use Alumbra Relevant to create, train, or interact with AI agents, we collect the prompts, instructions, knowledge sources, files, and other inputs you provide, as well as the outputs generated by those agents and any configurations you specify.

• Communications. If you contact us for support, provide feedback, or otherwise communicate with us, we collect the content of those communications and any information you choose to include.

2.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect certain information about your device and your interactions with the Services. We use minimal tracking technologies and do not use third-party advertising, marketing, or social media tracking pixels. The information we collect automatically includes:

• Device and Technical Information. IP address, device type and identifier, operating system, browser type, language preferences, and similar technical information.

• Usage Information. Information about how you use the Services, such as the pages or screens you view, the features you use, the dates and times of your access, and your interactions with content.

2.3 Cookies and Similar Technologies.

We use a limited set of cookies and similar technologies, including cookies that are strictly necessary to operate the Services (such as those that maintain your authenticated session, remember your preferences, and ensure security) and basic analytics cookies provided by our website platform that help us understand, in aggregate, how visitors interact with the Services. We do not use cookies for marketing, advertising, behavioral profiling, or cross-site tracking.

2.4 Information from Third Parties

We may receive information about you from third parties, such as our payment processor (to confirm transactions), identity verification providers, anti-fraud and security providers, and any third-party service you choose to connect to your account (for example, an AI model provider or data source you integrate with an AI agent you build on Alumbra Relevant).

3. HOW WE USE PERSONAL INFORMATION

We use personal information for the following purposes:

• Providing the Services. To create and maintain your account, deliver Inkling and Alumbra Relevant, operate AI agents you create, process transactions, and provide customer support.

• Scam Detection and Analysis. To analyze messages and metadata you submit to Inkling in order to identify potential scams, phishing attempts, fraudulent links, and similar threats, and to return detection results and recommendations to you.

• Security and Fraud Prevention. To monitor for, detect, investigate, prevent, and respond to security incidents, fraud, abuse, misuse of the Services, and violations of our terms or applicable law.

• Improving and Developing the Services. To understand how the Services are used, troubleshoot issues, evaluate the effectiveness of our scam detection models and other features, and improve and develop new products, features, and functionality. Where we use information for these purposes, we rely on aggregated, de-identified, or anonymized data wherever practical.

• Communications. To send you transactional messages relating to your account, security alerts, scam detection results, service announcements, and responses to your inquiries. We may also send you marketing communications about our products, from which you can opt out at any time.

• Legal and Compliance. To comply with our legal obligations, respond to lawful requests from public authorities, enforce our terms, and establish, exercise, or defend legal claims.

AI Model Training. We do not use the content of submissions you make to Inkling, the content of communications with your AI agents on Alumbra Relevant, or the personal information in your account to train large language models or other AI systems for purposes unrelated to providing and improving the Services to you. To the extent we use such information to improve our scam prevention or platform models, we do so using aggregated, de-identified, or anonymized data, or with appropriate safeguards consistent with this Policy. Where third-party AI models are used to power features of the Services, we contractually require those providers not to use your inputs or outputs to train their own general-purpose models.

4. HOW WE DISCLOSE PERSONAL INFORMATION

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We also do not share mobile opt-in data or consent with any third parties for marketing or promotional purposes (see Section 5.3). We disclose personal information only in the following circumstances:

• Service Providers. We share personal information with vendors and service providers who perform functions on our behalf, such as cloud hosting, infrastructure, payment processing (e.g., Stripe), customer support, email delivery, security monitoring, analytics for our internal use, and AI model providers that power Service features. These providers are bound by contract to use personal information only to provide services to us and to protect the information appropriately.

• At Your Direction. When you direct us to share information with a third party, such as connecting a third-party service or data source to an AI agent you create, we share personal information as needed to fulfill your request.

• Legal Process and Safety. We may disclose personal information when we believe in good faith that disclosure is necessary to (i) comply with applicable law, regulation, legal process, subpoena, or governmental request; (ii) enforce our terms of service or other agreements; (iii) protect the security, integrity, or availability of the Services; or (iv) protect the rights, property, or safety of Alumbra, our users, or others, including in connection with investigating fraud or scams.

• Business Transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction, subject to customary confidentiality arrangements.

• Aggregated or De-Identified Information. We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you for any lawful purpose.

5. SMS AND WHATSAPP MESSAGING

This section describes how text-message (SMS/MMS/RCS) and WhatsApp communications work in connection with the Services. It applies in addition to the other sections of this Policy.

5.1 Consent to Receive Messages

By providing your mobile phone number or WhatsApp identifier and opting in to receive messages from us, you expressly consent to receive text messages and/or WhatsApp messages from Alumbra at the number or identifier you provide. Your consent is not a condition of purchasing any goods or services. Message frequency may vary depending on your use of the Services and the type of messages you have requested.

5.2 Types of Messages

Depending on the Services you use and the consents you provide, you may receive: (i) transactional messages related to your account, such as verification codes, security alerts, billing notifications, and service updates; (ii) Inkling messages, including the results of analyses you have requested and related notifications; and (iii) where you have separately opted in, informational or marketing messages about Alumbra products and features.

5.3 Mobile Opt-In Data and Consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent (including your mobile phone number, WhatsApp identifier, and the fact of your opt-in) are excluded from the categories of personal information that we may disclose to third parties under this Policy. This information will not be shared with any third parties for marketing or promotional purposes, will not be sold or rented, and will not be shared with lead generators. We may share mobile opt-in data only with service providers acting on our behalf and under contract (for example, our messaging platform provider, such as Twilio) solely to deliver messages you have requested, with carriers and platform operators as necessary to transmit messages, and as otherwise required by law.

5.4 Message and Data Rates

Message and data rates may apply to any messages sent to you from us and to us from you. The actual rates depend on your wireless carrier or messaging service plan. If you have questions about your text or data plan, please contact your wireless provider. Carriers and messaging platforms are not liable for delayed or undelivered messages.

5.5 How to Opt Out (STOP) and Get Help (HELP)

You can opt out of receiving non-essential text messages from us at any time. To opt out by SMS, reply STOP, END, QUIT, CANCEL, UNSUBSCRIBE, REVOKE, or OPT OUT to any text message you receive from us. After you opt out, we may send you one final message confirming that your opt-out has been processed, and we will not send you further non-essential messages unless you re-subscribe. For WhatsApp, you may opt out by following the in-message instructions, by blocking our WhatsApp number, or by contacting us at the address in Section 14. You may continue to receive transactional or service-related messages necessary to provide the Services (such as security alerts) where required to operate your account.

For help with our messaging programs, reply HELP to any text message you receive from us, or contact us at info@alumbraai.com.

5.6 Messages You Forward or Submit to Inkling

Messages that you forward, share, or otherwise submit to Inkling for analysis are treated separately from outbound messages we send to you. Those submitted messages are processed as described in Section 6 below.

6. ADDITIONAL INFORMATION ABOUT INKLING

The Inkling is made available to consumers through their financial institution. Because Inkling involves the submission and automated analysis of suspicious messages, we want to be especially clear about how it works:

• How activation works. Your financial institution provides you with a short code and a passcode that you text to activate Inkling. We use the passcode solely to verify that you are authorized to use the Service through that financial institution's program. We do not receive your account information from the financial institution beyond what is necessary to activate and provide the Service.

• Please minimize personal information in your submissions. Inkling is designed to analyze the structure and content of suspicious messages, not to process your personal information. You should not include your own personal information (such as your full name, account numbers, Social Security number, passwords, login credentials, payment card information, or other sensitive identifiers) in messages or screenshots you submit. Although our systems are designed to automatically remove personal information before analysis, the safest approach is not to submit it in the first place. Where practical, you should redact or crop sensitive details from screenshots before sending them to us.

• What you can submit. You can text or send screenshots of suspicious messages you have received. Our systems automatically strip personally identifiable information (such as names, phone numbers, account numbers, email addresses, addresses, and other identifying details) from the submitted content before our scam-analysis systems process it. We do not process or retain the personally identifiable information that is removed from your submissions.

• What we return to you. After analysis, we return to you an assessment indicating whether the submitted content is a known scam or exhibits scam indicators or red flags, together with a link to a web portal where you can report the scam in more detail and access educational resources to help you protect yourself from future scams.

• Improving the Service. We use only aggregated, de-identified, and anonymized data (from which personally identifiable information has been removed) to improve Inkling and our detection models. We do not use your personally identifiable information for service-improvement purposes.

• Third parties referenced in your submissions. Submissions may contain information about other individuals, such as the sender of a suspicious message. As described above, our automated PII-removal process is designed to strip identifying information from submissions before analysis.

• Detection is not a guarantee. The Inkling provides automated risk assessments and is not a substitute for your own judgment, your financial institution's fraud-prevention processes, or advice from law enforcement. We do not guarantee that Inkling will identify every scam or that every flagged message is in fact a scam.

7. ADDITIONAL INFORMATION ABOUT ALUMBRA RELEVANT

Alumbra Relevant is our AI upskilling platform, which provides training and enablement tools to help users understand how to use AI safely. If you use Alumbra Relevant to create or interact with AI agents, please note the following:

• Your inputs and configurations. Prompts, instructions, knowledge sources, files, and other inputs you provide to an AI agent, as well as the outputs the agent generates, are processed to operate the agent and provide the Service to you. We do not use this content to train general-purpose AI models.

• AI agents acting on your behalf. If you configure an AI agent to access third-party services, data sources, or tools, the agent will process information from those sources in order to perform the tasks you direct. You are responsible for ensuring you have the right to provide such information and to authorize the agent's access.

• Underlying AI providers. Alumbra Relevant may be powered in part by third-party AI model providers. We contractually require those providers not to use your inputs or outputs to train their own models, except as needed to provide the underlying service to us.

• Sponsoring organizations. Where access to Alumbra Relevant is provided through a financial institution or other sponsoring organization, we may share with that organization information about your enrollment, completion of training modules, and aggregate usage of the platform, consistent with the agreement between us and that organization. We do not share the content of your interactions with AI agents with the sponsoring organization unless you direct us to do so.

8. DATA RETENTION

We retain personal information for as long as necessary to provide the Services, fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The actual retention period depends on the type of information, the context in which we collected it, and applicable legal requirements.

In general, we retain account information for as long as your account is active and for a reasonable period afterward. For Inkling, personally identifiable information contained within messages or screenshots you submit is removed at the time of submission and is not retained. Only the de-identified, anonymized content of submissions is used to provide your scam analysis and, in aggregated form, to improve the Service. When personal information collected through other Services is no longer needed, we will delete, de-identify, or anonymize it in accordance with our retention policies.

9. SECURITY

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, and loss. These measures include encryption in transit, access controls, authentication requirements, logging and monitoring, and personnel training. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

10. YOUR PRIVACY RIGHTS

Although the Services are offered in the United States, we extend the following privacy rights, modeled on the California Consumer Privacy Act (as amended by the California Privacy Rights Act), to all of our users, regardless of where you reside:

• Right to Know / Access. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclosed it.

• Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (for example, where we are required to retain information for legal or security reasons).

• Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.

• Right to Opt Out of Sales and Sharing. You have the right to opt out of the sale or sharing of personal information. As noted above, we do not sell personal information and we do not share personal information for cross-context behavioral advertising.

• Right to Limit Use of Sensitive Personal Information. To the extent we collect sensitive personal information, you have the right to direct us to limit our use of that information to purposes specified by applicable law.

• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

• Right to Appeal. If we deny your request, you may appeal our decision by contacting us at the address below.

How to exercise your rights. You may exercise these rights by emailing us at info@alumbraai.com or by writing to us at the address in Section 14. We will verify your identity before responding to your request, which may require us to ask you to provide information that can be reasonably matched against information we maintain. You may also use an authorized agent to submit a request on your behalf, subject to verification. We will respond within the time frames required by applicable law.

Automated decision-making. The Inkling uses automated processing, including AI models, to generate risk assessments about messages you submit. These assessments are advisory in nature; we do not use them to make decisions that produce legal or similarly significant effects on you without human involvement. You may contact us to ask questions about how an automated assessment was generated.

11. CHILDREN'S PRIVACY

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not use the Services or provide any personal information to us. If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe that a child under 13 has provided personal information to us, please contact us at the address in Section 14.

If you are between the ages of 13 and 17, you may use the Services only with the involvement and consent of a parent or legal guardian.

12. THIRD-PARTY LINKS AND SERVICES

The Services may contain links to, or otherwise integrate with, third-party websites, applications, or services that we do not own or control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third parties whose services you use.

13. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will notify you by posting the updated Policy on our website and updating the "Last Updated" date above, and, where appropriate, by providing additional notice (such as by email or in-Service notification). Your continued use of the Services after the effective date of any updated Policy constitutes your acceptance of the changes.

14. HOW TO CONTACT US

If you have any questions, comments, or requests regarding this Policy or our privacy practices, please contact us at:

Alumbra Solutions LLC
101 S Tryon Street, Suite 2700
Charlotte, NC 28280
Email: info@alumbraai.com