FOLDER CO LLC PRIVACY POLICY

Effective Date: July 19, 2026

Last Updated: July 19, 2026

Legal Entity: Folder Co LLC

Business Address: 140 Blackstone St, Uxbridge, MA 01569

Folder Co LLC, with an address at 140 Blackstone St, Uxbridge, Massachusetts 01569 ("Folder Co," "we," "us," or "our"), respects the privacy of the people and businesses that use our services and the individuals whose information is included in a Folder Co file. This Privacy Policy explains how Folder Co collects, uses, discloses, retains, and protects personal information in connection with folderco.io and our related websites, applications, workflow tools, communications, and services (collectively, the "Services").

Folder Co is a business workflow and file-management platform designed for the collision-repair, independent-appraisal, vehicle-valuation, diminished-value, right-to-appraisal, total-loss, and related automotive industries. Because customers may use the Services to manage repair and claim files, the Services can contain personal information about business users, vehicle owners, claimants, appraisers, repair professionals, adjusters, insurers, vendors, and other participants.

This Policy is intended for users and individuals in the United States. It should be read together with Folder Co's Terms of Service and any customer agreement, data-processing terms, or feature-specific notice that applies to your use of the Services.

1. Who This Policy Covers

For this Policy:

A "Customer" is a business, organization, sole proprietor, or professional that creates, purchases, administers, or uses a Folder Co workspace or service.

An "Authorized User" is an individual permitted to access a Customer's workspace, including an administrator, body shop, appraiser, owner, umpire, employee, contractor, or other invited participant.

"Customer Content" is information, files, records, photographs, communications, documents, and other content submitted to or generated through the Services by or for a Customer.

"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household. The term includes "personal data" and similar terms used by applicable privacy laws.

This Policy applies to visitors to our website, Customers, Authorized Users, people who communicate with us, and individuals whose Personal Information appears in Customer Content.

2. Folder Co's Role and the Customer's Role

Folder Co handles Personal Information in two different capacities.

Information Folder Co controls

Folder Co determines how and why we use information needed to operate our business and the Services, including website information, account registration data, subscription and billing records, security logs, support communications, and information used to maintain and improve the platform. For this information, Folder Co acts as the business or controller where those terms apply.

Customer Content processed for Customers

Customers decide what claim, repair, appraisal, vehicle, and client information they place in their workspaces; who may access it; the purpose for which it is used; and how long it should be maintained, subject to the Services and applicable law. When Folder Co stores or otherwise processes Customer Content on a Customer's behalf, Folder Co generally acts as that Customer's service provider or processor.

Customers are responsible for:

Having a lawful basis and appropriate authority to collect, upload, use, and disclose Customer Content.

Providing any privacy notices and obtaining any permissions or consents required from vehicle owners, claimants, employees, contractors, or other individuals.

Limiting Customer Content to information reasonably necessary for the applicable file or service.

Configuring workspace permissions and maintaining the confidentiality of user credentials.

Responding to privacy requests relating to information the Customer controls.

If your information appears in a Folder Co file created by a body shop, appraiser, insurer, firm, or other Customer, you should normally direct your request to that Customer first. We will assist Customers with verified requests as required by applicable law and our agreements.

3. Personal Information We Collect

The information we collect depends on how the Services are used and which features and integrations are enabled.

Account and business information

We may collect names, business names, job titles, professional roles, mailing and business addresses, email addresses, telephone and fax numbers, websites, usernames, authentication information, profile information, licensing or credential information, workspace memberships, permissions, and administrator settings.

Vehicle, repair, appraisal, and claim information

Customer Content may include:

Vehicle-owner, claimant, insured, and other contact information.

Vehicle identification numbers, license-plate information, year, make, model, trim, mileage, options, condition, location, service history, and warranty information.

Dates and descriptions of losses, damage information, repair status, photographs, video, audio, measurements, scans, diagnostic information, and calibration records.

Claim numbers, policy-related information, insurer information, adjuster and appraiser information, deductibles, settlement figures, rental information, and claim communications.

Estimates, supplements, repair plans, labor operations, parts information, invoices, receipts, authorizations, appraisals, market comparables, valuation inputs, diminished-value analyses, reports, awards, notes, correspondence, and supporting documents.

Signatures, acknowledgments, permissions, file histories, workflow milestones, and audit records.

Files, communications, and collaboration content

We collect files and content submitted through the Services, including documents, images, messages, notes, comments, emails generated through the platform, support submissions, and communications among authorized participants. Workspace administrators and other authorized participants may be able to view, export, edit, share, or delete this content according to their roles.

AI, OCR, and automation information

When a Customer uses optical character recognition, artificial intelligence, document extraction, report generation, valuation assistance, or other automated features, we process the submitted inputs and the resulting extracted fields, classifications, summaries, calculations, recommendations, and outputs. Users are responsible for reviewing automated outputs for accuracy before relying on or distributing them.

Folder Co may use Customer Content, interactions with AI-powered features, user feedback, extracted data, and AI or OCR inputs and outputs to develop, test, train, evaluate, validate, and improve Folder Co's artificial-intelligence models, extraction systems, automations, and related Services. This may include models and features that benefit other Folder Co customers.

Where reasonably practicable and consistent with the development purpose, Folder Co will minimize, aggregate, mask, or de-identify training and evaluation data and limit the direct identifiers included in development datasets. Folder Co does not use complete payment-card numbers or online-banking credentials to train AI models.

Folder Co may use contracted AI and technology providers to perform processing for these purposes. Unless clearly disclosed in the applicable feature terms or authorized by the Customer, Folder Co does not authorize a third-party AI provider to use Customer Content to train models for that provider's independent products or unrelated purposes. Any account-level or contractual controls that Folder Co makes available for AI development use will be described in the applicable settings or customer agreement.

We may also use de-identified or aggregated information that does not reasonably identify a person, vehicle owner, claim, or Customer to evaluate performance, improve workflows, create industry insights, and develop the Services. We do not attempt to reidentify information maintained in de-identified form except to test whether our de-identification methods are effective or as permitted by law.

Subscription, billing, and transaction information

We may collect subscription level, billing contact information, invoices, transaction amounts, payment status, credits, refunds, disputes, payout status, tax-related transaction information, and related records. Payment-card, bank-account, identity-verification, and payout information may be collected directly by Stripe or another payment provider, as described in Section 8.

Device, usage, and log information

We may automatically collect IP address, browser type, operating system, device type and identifiers, referring pages, pages or features used, access dates and times, session activity, error and performance data, approximate location derived from IP address, authentication events, and security logs.

Support, sales, and communications information

When you contact us, request a demonstration, submit feedback, participate in a survey, or communicate with our support or sales teams, we collect your contact information and the content and history of those communications. Calls or online sessions will be recorded only when notice or consent is provided as required by law.

Cookies and similar technologies

We use cookies, local storage, pixels, software development kits, and similar technologies to authenticate users, maintain sessions, remember settings, secure the Services, understand platform performance, diagnose errors, and analyze use. Section 9 describes these technologies and available choices.

Information from connected services and other sources

At a Customer's direction, we may receive information from connected payment, accounting, electronic-signature, email, calendar, communications, valuation, vehicle-data, parts, estimating, storage, or other services. We may also receive business contact information, vehicle and market information, fraud-prevention signals, and information from public or commercially available sources where permitted by law.

4. Information Customers Should Not Upload Unless Necessary and Authorized

Folder Co is designed for automotive workflow and claim-related records. Customers should not upload Social Security numbers, complete payment-card numbers, online-banking credentials, medical records, biometric identifiers, or other highly sensitive information unless the information is necessary for an enabled feature, the Customer has lawful authority to provide it, and Folder Co has agreed to process it.

Folder Co is not intended to serve as a system of record for protected health information under HIPAA, consumer credit reports regulated by the Fair Credit Reporting Act, or information unrelated to an automotive repair, appraisal, valuation, claim, payment, or associated business function.

5. How We Use Personal Information

We use Personal Information to:

Create and administer accounts, workspaces, roles, and permissions.

Provide file storage, repair-planning, appraisal, valuation, document, reporting, billing, communication, and collaboration features.

Perform OCR, AI-assisted extraction, calculations, classification, document generation, workflow automation, and related functions selected by Customers.

Develop, train, test, evaluate, validate, secure, and improve Folder Co's AI models, OCR systems, automations, and related features as described in Section 3 and the applicable customer agreement.

Process subscriptions, payments, payouts, invoices, refunds, credits, and transaction records.

Connect the Services with third-party products at a Customer's direction.

Authenticate users, prevent unauthorized access, detect fraud or misuse, protect files, maintain audit logs, and investigate security events.

Provide support, respond to inquiries, troubleshoot issues, and communicate about accounts, transactions, service changes, security, and maintenance.

Monitor reliability and performance, correct errors, improve usability, develop new features, and understand how the Services are used.

Create aggregated or de-identified statistics, benchmarks, and operational insights that do not reasonably identify individuals or Customers.

Enforce our agreements, protect the rights and safety of Folder Co, our Customers, users, and others, and resolve disputes.

Comply with law, legal process, accounting requirements, regulatory obligations, and lawful government requests.

Send product announcements, educational information, or marketing communications to business contacts, subject to applicable law and available opt-out choices.

We do not use Customer Content to market unrelated products to vehicle owners, claimants, or other individuals contained in a Customer file.

6. When We Disclose Personal Information

We disclose Personal Information only as reasonably necessary for the purposes described in this Policy.

Customers, administrators, and authorized participants

Customer administrators control workspace access. We disclose Customer Content to the Customer and to Authorized Users according to workspace roles, file assignments, invitations, sharing settings, and Customer instructions. A Customer may direct the Services to share information with vehicle owners, body shops, appraisers, umpires, insurers, adjusters, independent appraisal firms, attorneys, accountants, vendors, repair professionals, or other participants connected to a file.

Service providers and subprocessors

We use vendors to provide infrastructure and business functions such as cloud hosting, databases, storage, authentication, cybersecurity, monitoring, customer support, communications, email delivery, analytics, document processing, OCR, artificial intelligence, payments, accounting, electronic signatures, and professional services. These providers may process Personal Information only to perform contracted services, protect the Services, or satisfy applicable legal obligations. We require appropriate confidentiality, security, and data-protection commitments where required.

Connected services selected by Customers

When a Customer enables or directs an integration, we disclose the information reasonably necessary to provide that connection. The third party's use of information is governed by its own agreement and privacy policy. Disabling an integration stops future transfers through Folder Co but may not delete information previously received and retained by the third party.

Legal, safety, and rights-protection disclosures

We may disclose information when we reasonably believe disclosure is necessary to comply with law, regulation, subpoena, court order, or other legal process; respond to a lawful government request; investigate fraud, abuse, or a security event; enforce our agreements; establish, exercise, or defend legal claims; or protect the rights, property, safety, and security of Folder Co, our Customers, users, or the public.

When legally permitted and reasonably practicable, we will direct a request for Customer Content to the applicable Customer or notify the Customer before disclosure.

Business transactions

Information may be disclosed in connection with a proposed or completed merger, financing, acquisition, reorganization, sale of assets, bankruptcy, receivership, or transfer of some or all of our business. Any successor will be required to handle Personal Information consistently with this Policy or provide notice of materially different practices where required by law.

With permission

We may disclose information for another purpose when the relevant Customer or individual directs us to do so or provides permission.

7. We Do Not Sell Personal Information

Folder Co does not sell Personal Information for money. We also do not share Personal Information for cross-context behavioral advertising or use Customer Content for targeted advertising unrelated to the Services.

Some privacy laws define "sale" or "sharing" broadly. Our disclosures to service providers that process information under contract, to connected services selected by a Customer, and to participants a Customer authorizes to receive a file are made to provide the Services and are not intended as sales of Personal Information.

Folder Co does not knowingly sell or share the Personal Information of individuals under 18 for targeted advertising. We do not use sensitive Personal Information to infer characteristics about individuals or for purposes that require a right to limit under applicable law.

8. Stripe, Stripe Connect, and Payment Services

Customers may choose to use Stripe, including Stripe Connect, to accept payments, send payouts, manage connected accounts, or use other financial features. Stripe may collect and process names, contact information, dates of birth, tax or government identifiers, identity documents, bank-account information, payment-card information, business-ownership information, transaction information, and fraud-prevention data. Depending on the feature and context, Stripe may act as an independent controller, a processor for Folder Co or a Customer, or both.

Folder Co may receive information from Stripe such as a Stripe customer or connected-account identifier, onboarding and verification status, payment and payout status, transaction amount, fees, invoice or subscription status, refund or dispute information, and limited payment-method details such as the card brand and last four digits when Stripe makes them available.

Folder Co generally does not receive or store the complete payment-card number or online-banking credentials that a user enters directly into a Stripe-hosted or Stripe-controlled interface. Stripe's collection and use of information is governed by the Stripe agreements and Stripe Privacy Policy available at https://stripe.com/privacy.

Users should review Stripe's notices before enabling Stripe or submitting information to it. Disconnecting Stripe from Folder Co does not require Stripe or its financial partners to delete information they must retain for payment processing, identity verification, fraud prevention, tax, anti-money-laundering, dispute, or other legal purposes.

9. Cookies, Analytics, and Privacy Signals

We may use the following categories of cookies and similar technologies:

Strictly necessary technologies for login, authentication, security, fraud prevention, load balancing, and core platform operation.

Functional technologies that remember preferences and workspace settings.

Analytics and performance technologies that help us understand feature use, diagnose errors, and improve reliability.

Folder Co does not use Customer Content to create advertising profiles. We do not use third-party advertising cookies to target vehicle owners or claimants based on information contained in a file.

You may control cookies through your browser or device settings. Blocking necessary technologies may prevent parts of the Services from working. Because there is not a universally accepted response to browser "Do Not Track" signals, our Services may not respond to those signals. We honor legally recognized opt-out preference signals, such as Global Privacy Control, where required and applicable to the processing at issue.

10. Data Retention and Deletion

We retain Personal Information only for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, comply with Customer instructions and contractual commitments, maintain security and audit records, resolve disputes, enforce agreements, and satisfy legal, accounting, tax, insurance, and regulatory requirements.

Retention depends on the nature and sensitivity of the information, the applicable Customer's settings and instructions, the status of the account or file, the risk of harm from unauthorized use, and legal requirements.

Customers may delete certain files or information through available account tools. When a Customer closes an account or requests deletion, we delete or de-identify Customer Content within a commercially reasonable period, subject to the Customer agreement and lawful exceptions. Information may remain temporarily in encrypted backups and disaster-recovery systems until overwritten through the ordinary backup cycle. We may retain limited records of the request, transaction records, security logs, fraud-prevention information, and information subject to a legal hold or retention obligation.

If Customer Content has been exported, emailed, shared with another authorized participant, or transferred to a connected service, deletion from Folder Co does not delete copies held by those recipients.

11. Security and Massachusetts Safeguards

Folder Co uses commercially reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, acquisition, use, disclosure, alteration, loss, or destruction. Depending on the data and system, safeguards may include encryption in transit and at rest, access controls, authentication protections, role-based permissions, logging, monitoring, backups, vulnerability management, vendor review, employee or contractor confidentiality obligations, and incident-response procedures.

For Personal Information of Massachusetts residents that Folder Co owns or licenses, Folder Co maintains safeguards designed to comply with applicable Massachusetts requirements, including 201 CMR 17.00. Folder Co also maintains processes intended to support legally required security-incident assessment and notification, including obligations under Massachusetts General Laws Chapter 93H.

No system, storage method, or Internet transmission is completely secure. Customers and users are responsible for using unique credentials, protecting passwords and authentication methods, limiting permissions, maintaining secure devices, promptly removing former users, and notifying us of suspected unauthorized access.

12. Privacy Rights and Choices

Depending on where you live and subject to legal exceptions, you may have the right to:

Know whether we process your Personal Information and obtain information about our collection, use, and disclosure practices.

Access or obtain a copy of Personal Information.

Correct inaccurate Personal Information.

Delete Personal Information.

Obtain certain information in a portable format.

Opt out of the sale or sharing of Personal Information, targeted advertising, or certain profiling with legal or similarly significant effects.

Limit certain uses of sensitive Personal Information or withdraw consent where processing is based on consent.

Appeal a decision concerning a privacy request.

Receive equal service and not be discriminated against for exercising a privacy right.

Because Folder Co does not sell Personal Information or share it for cross-context behavioral advertising, we do not currently offer a separate "Do Not Sell or Share" link. If our practices change, we will provide any notice and choice required by law before the change applies.

You may update certain account information through the Services. To make another privacy request, email privacy@folderco.io or use the support request method available through the Services. Please describe your request and the information or account involved.

We may verify your identity and authority before completing a request. Verification may require confirming control of an email address, account, workspace, or other information associated with the request. An authorized agent may submit a request when permitted by law, but we may require proof of authorization and verification of the individual. If we deny a request, we will explain the basis and any available appeal process when required.

If Folder Co processes information solely for a Customer, we may refer the request to that Customer and assist it in responding. Folder Co cannot delete information that a Customer is legally required to maintain or that falls within another lawful exception.

You may unsubscribe from marketing emails using the link in the message or by contacting us. You will continue to receive necessary account, transaction, security, legal, and service communications.

13. Additional U.S. State Disclosures

This section supplements the rest of the Policy for residents of states with comprehensive consumer privacy laws, including California, when those laws apply to Folder Co's processing.

During the preceding twelve months, Folder Co may have collected the following statutory categories of Personal Information: identifiers and customer-record information; commercial and transaction information; professional or employment-related information; Internet, device, and network-activity information; approximate geolocation; audio, electronic, visual, and similar information; sensitive Personal Information such as account credentials and, when required for a selected payment or verification feature, government-identification or financial information; and inferences or outputs generated from information submitted to the Services.

We collect these categories from individuals, Customers and their Authorized Users, connected services, payment providers, business partners, public or commercially available sources, and automatically from use of the Services. We use and disclose them for the business and commercial purposes described in Sections 5 and 6.

The categories of recipients may include the applicable Customer and its Authorized Users; recipients selected by the Customer; cloud, security, communications, analytics, support, document-processing, AI, OCR, payment, accounting, electronic-signature, and professional-service providers; connected services; government authorities and legal recipients; and parties involved in a business transaction.

Folder Co has not sold Personal Information for money or shared Personal Information for cross-context behavioral advertising during the preceding twelve months. We do not have actual knowledge that we have sold or shared the Personal Information of anyone under 16.

California residents may also have the rights to know the categories and specific pieces of Personal Information collected, sources, purposes, and recipients; request correction or deletion; opt out of sale or sharing; limit certain uses of sensitive Personal Information; and receive nondiscriminatory treatment. Folder Co does not use or disclose sensitive Personal Information for purposes that require a right to limit under the California Consumer Privacy Act, as amended.

We will provide additional state-specific notices or request procedures when legally required. Rights may not apply when Folder Co is acting solely as a service provider or processor for a Customer, when a statutory threshold or exemption applies, or when another legal exception permits or requires us to retain or use information.

14. Children

The Services are designed for businesses and automotive professionals and are not directed to children. Individuals must be at least 18 years old or the age of legal majority in their jurisdiction to create or administer an account unless an organization has expressly authorized and lawfully supervised their access.

We do not knowingly collect Personal Information directly from children under 13. If we learn that a child under 13 provided Personal Information directly to Folder Co without legally valid parental authorization, we will take reasonable steps to delete it. Customer Content may incidentally refer to a minor, such as a vehicle owner, passenger, claimant, or family member. In that circumstance, the Customer is responsible for having lawful authority and limiting the information to what is necessary.

15. Third-Party Services and Links

The Services may link to or integrate with websites, applications, data sources, or services controlled by third parties. This Policy does not govern a third party's independent collection, use, retention, or disclosure of information. Customers and users should review the applicable third-party terms and privacy notices before enabling an integration or providing information.

16. United States Processing

Folder Co is based in the United States, and the Services are currently intended primarily for United States customers and claims. Personal Information may be processed and stored in the United States and in other locations where our contracted service providers operate. Those locations may have privacy laws different from the laws where an individual resides.

Customers must not use the Services for individuals outside the United States unless the Customer has determined that the use is lawful and has entered into any additional terms required by Folder Co.

17. Changes to This Policy

We may update this Policy to reflect changes in the Services, technology, law, or our practices. We will update the "Last Updated" date and post the revised Policy through the Services or on our website. If a change materially reduces privacy protections or materially changes how we use Personal Information, we will provide additional notice and obtain consent when required by law.

18. Contact Folder Co

For privacy questions, requests, or complaints, contact:

Folder Co LLC

Mailing Address: 140 Blackstone St, Uxbridge, MA 01569

Email: privacy@folderco.io

Website: https://folderco.io

Support: Through the support request method available within the Services