Vzable (“Vzable”, “us”, “our”, and “we”) a d/b/a of Pathwise LLC is committed to maintaining robust privacy protections for Users of its App and the Services provided through the App (collectively the “Platform”) located at: https://vzable.com/terms-mobile/ Our Mobile App Privacy Policy (“Privacy Policy”) is designed to help you understand how we collect, use, and safeguard the information you provide to us and to assist you in making informed decisions when using our Platform.

By accepting our Privacy Policy and Mobile App Terms of Use (located at https://vzable.com/terms-mobile/)(“Terms”), you consent to our collection, storage, use and disclosure of your personal information as described in this Privacy Policy. Capitalized terms in this policy have the same meaning given to them in our Terms of Use, unless otherwise defined in this policy.

Children’s Online Privacy Protection Act

We do not intentionally gather Personal Information from individuals who are under the age of 13 without parental consent. Account Holders who create Learner Profiles for individuals under the age of 13 are required to attest and verify that they have obtained the parental consent necessary to comply with COPPA. In the event that we learn that we have collected personal information from a child under age 13 without parental consent, we will delete that information as quickly as possible. If you believe that we might have any information from or about a child under 13 without parental consent, please contact us at info@vzable.com.

In addition to the requirements of COPPA, certain U.S. state laws extend online privacy protections to minors above the age of 13. Vzable complies with these state-level requirements where applicable.

Types of Data We Collect

We collect “Non-Personal Information” and “Personal Information.” Non-Personal Information includes information that cannot be used to personally identify you, such as anonymous usage data, general demographic information we may collect, referring/exit pages and URLs, platform types, preferences you submit and preferences that are generated based on the data you submit and number of clicks. “Personal Information” means data that allows someone to identify or contact you, including, for example, your name, address, telephone number, e-mail address, as well as any other non-public information about you that is associated with or linked to any of the foregoing data.

Information You Provide to Us

• We may collect Personal Information from you, such as your name and e-mail address when you complete a contact form on our Platform.
• When creating an Account, we may collect the Account Holder’s name, email address, and password.
• When creating a Learner Profile, we may collect information such as the Learner’s name, age, and grade level (if applicable), or password.
• When a Learner completes a Reflection, we may collect additional information that the Learner or Account Holder knowingly provides in the Reflection responses, such as general information about learning preferences and answers to the Reflection prompts.
• If you purchase access to the Platform through an App Store Provider, all payment transactions are processed exclusively by the applicable App Store provider. Vzable does not collect or store payment card information or any other financial account data. Payment processing is subject to the App Store Provider’s respective privacy policies.
• We retain information on your behalf, such as Learner Profiles, Reflection responses, and generated reports that you store using your Account.
• If you provide us feedback or contact us via e-mail, we will collect your name and e-mail address, as well as any other content included in the e-mail, in order to send you a reply.
• When you User Content on the Platform or on a social media site where we have a page or presence the information contained in your posting may be republished on our Platform and other users may be able to see them.

Information Collected via Technology

• In an effort to improve the quality of the Platform, we track information provided to us by your browser or by our software application when you view or use the Platform, such as the website you came from (known as the “referring URL”), the type of browser or device you use, the device from which you connected to the Platform, the time and date of access, and other information that does not personally identify you.  We track this information using cookies, and similar technologieswhich include an anonymous unique identifier. Cookies are sent to a user’s browser from our servers and are stored on the user’s computer hard drive. Sending a cookie to a user’s browser or device enables us to collect Non-Personal information about that user and keep a record of the user’s preferences when utilizing our Platform, both on an individual and aggregate basis.
• We may also use third-party analytics platforms such as Google Analytics or PostHog to collect non-personal information about how you use and interact with our Platform. Such third-party analytics services may use cookies and other technologies to gather information such as the features you used, your IP address, a date/time stamp for your activity and which source referred you to the Platform. This helps us provide a better user experience and improve usability.
• If you enable push notifications, we store your device push notification token solely for the purpose of delivering notifications related to your Account and Reflection activity. You may disable push notifications at any time through your device settings.
• Vzable does not engage in or permit any form of targeted or behavior-based advertising on its Platform, nor do we allow third parties to do so. More specifically: (i) we do not use Personal Information from any user, including minors, for advertising or marketing purposes; (ii) we do not engage in cross-site tracking which tracks users across third-party websites, social media platforms, or applications; and (iii) we do not share device identifiers, IP addresses, or other technical data with advertising networks or partners for profiling or audience measurement.
• Any analytics tools used on the Platform are limited to de-identified, aggregate metrics strictly for educational, operational, and security-related purposes. These tools help us understand usage patterns, improve functionality, and ensure system reliability. Vzable’s analytics partners are contractually restricted to use collected data solely to provide aggregate, de-identified insights that improve the Platform’s performance and security. They are expressly prohibited from using such data for advertising, marketing, or any commercial purpose unrelated to Vzable’s mission.

Use of Your Personal Information

Depending on the features of the Platform you use, we may process your Personal Information based on one or more of the following legal bases:

Your Consent: You may give us permission to process specific data to enhance your experience on the Platform. Example: When a Participant takes a Survey on your Platform, we process the information provided to us to generate Survey results.

Contractual Obligations: We may process personal data to fulfill our contractual obligations to you, such as managing your Account and delivering the requested Services.

Legitimate Interests: We may process personal data to improve our Services, manage the Platform more effectively, and secure our Platform, as long as these interests do not override your rights. Examples: Conducting vulnerability assessments to protect your data or analyzing usage data to identify and fix bugs.

Legal Obligations: We may be required to process certain personal data to comply with applicable laws and regulations.

Below is a table that describes some of the purposes for which we process your personal data, the legal basis for processing, and examples where applicable:

Purpose of Processing	Legal Basis for Processing	Example
Account Management and Security	Contractual necessity	To create and secure your Account on our Platform, verify your identity, and manage user access.
Service Provision and Personalization	Contractual necessity and consent	To deliver the core components of the Platform, including administering Reflections, generating and presenting results and personalized learning motivator insights, providing AI-powered analysis, and enabling Account Holders to manage Learner Profiles.
Personalized Content and Feature Delivery	Legitimate interest	To tailor content, features, and services based on your interactions and preferences on the Platform.
Administrative Communication	Contractual necessity	Send you notifications about your account, such as verification emails, security alerts, and maintenance updates.
Customer Support and User Feedback	Legitimate interest	Respond to your inquiries, provide customer support, and address any questions or feedback you may have.
Data Analysis and Platform Improvements	Legitimate interest	Conduct data analysis to understand user engagement, improve the Platform, and ensure a quality user experience.

Use of Non-Personal Information

In general, we use Non-Personal Information to help us improve the Platform and customize the user experience. We also aggregate Non-Personal Information in order to track trends and analyze use patterns on the Platform. This Privacy Policy does not limit in any way our use or disclosure of Non-Personal Information and we reserve the right to use and disclose such Non-Personal Information to our partners and other third parties at our discretion.

If our information practices change at any time in the future, we will post the policy changes to the Platform so that you may opt out of the new information practices. We suggest that you check the Platform periodically if you are concerned about how your information is used.

Disclosure of Your Personal Information

Our company does not sell your personal information. We do, however, have relationships with third parties to provide our Platform to you in which your personal information may be shared. We disclose your Personal Information as described below and as described elsewhere in this Privacy Policy.

• Learner Profiles and Shared Data. Account Holders who create Learner Profiles for individuals in their care acknowledge and agree that Reflection responses and results generated for those Learner Profiles may be accessed and managed by the Account Holder. The Account Holder is responsible for obtaining any necessary consents and for managing access to Learner Profile data in a manner consistent with applicable law. Anonymized Reflection response data, with researchers for educational or scholarly research purposes. An Account Holder’s creation of a Learner Profile and use of the Reflection features indicates the Account Holder’s, and where required by law their child’s parent or guardian’s, understanding of and consent to these terms regarding data sharing and research use. Third-Party Service Providers. We may share your Personal Information with third-party service providers to facilitate the Services we offer you through our Platform. Specifically, these service providers assist us in: Payment Processing: We use third-party payment processors to facilitate purchases. When you provide payment information to Vzable, we collect and process the necessary details for completing the transaction, including payment and billing information. Vzable does not store sensitive financial information directly.

• In-App Purchase Management: We use RevenueCat to manage in-app purchases and entitlements. RevenueCat processes purchase tokens and anonymized user identifiers to validate purchases and manage access to Platform features.

• Account Creation, Verification, and Authentication: We enable third-party service providers to facilitate account creation, verification, and authentication. If you sign in using Apple or Google, authentication is facilitated by the respective platform. Vzable receives only your name and email address (or an anonymized identifier in the case of Apple’s “Hide My Email” feature) to create your Account.

• Cloud Infrastructure: We store User data on Supabase, a third-party cloud provider that provides database, authentication, and backend infrastructure services. Supabase hosts Account data, Learner Profiles, Reflection data, and generated reports.

• Use of AI Tools: We use OpenAI’s artificial intelligence services to analyze Reflection responses and generate personalized narrative insights within reports. Reflection response data is sent to OpenAI for this purpose. Vzable designs prompts to protect privacy, but Users should be aware that Reflection data is processed by OpenAI’s systems.

• Hosting and Customer Support: Service providers help host our Platform, manage our servers, and provide customer support to address your inquiries.

• Quality Assurance and Performance Monitoring: We conduct quality assurance testing and monitor the Platform’s performance to ensure it operates as expected.

• Data Analysis: Third parties may assist in conducting data analysis to understand user engagement, and improving the Platform.

• Technical Support and Troubleshooting: Our service providers offer technical support and assist in troubleshooting issues on the Platform.

• Transactional Emails: We use SendGrid, a Twilio company, to send transactional emails such as Learner Profile invite notifications and account-related communications. When sending an email on your behalf, SendGrid processes the recipient’s email address and the email content. SendGrid does not use this data for marketing or advertising purposes.

• Additional Services: We work with third parties to provide other services aimed at enhancing the user experience on our Platform.

These service providers are contractually obligated to protect the confidentiality and security of your Personal Information and to use it only as directed by us.

Affiliates and Business Partners. We may share your Personal Information with our affiliates and business partners to perform functions and provide services on our behalf, such as improving the Platform’s functionality. These partners are required to use your Personal Information only for the purposes outlined by us and in compliance with applicable laws.

Corporate Transactions. In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your Personal Information may be transferred to a successor entity as part of the transaction. We will take reasonable steps to ensure that your Personal Information remains secure and is handled in accordance with this Privacy Policy.

Other Disclosures. Vzable is committed to protecting your privacy and the confidentiality of your personal information. We will not disclose your Personal Information to any third parties except in the following limited circumstances, and only to the extent required or permitted by law:

• Legal Obligations: We may disclose Personal Information if required to comply with applicable laws, regulations, or legal processes (such as subpoenas, court orders, or other legal requests). In such cases, we will take reasonable measures to limit the scope of the information disclosed and, where possible, will notify you in advance.

• Protection and Safety: We may disclose Personal Information to protect the rights, property, or safety of Vzable, our users, or others. This includes actions to detect, prevent, or otherwise address fraud, security, or technical issues, and to enforce our Terms of Use.

• Responding to Government Requests: In the rare event we receive a request from a public authority, including for law enforcement or national security purposes, we will carefully evaluate the legality and necessity of the request. Where permitted, Vzable will strive to notify you and to seek the minimum disclosure possible in response to such requests. Your personal information is treated with the utmost sensitivity, and we will take all reasonable steps to protect it from unwarranted disclosure.

Commitment to Transparency. Vzable believes in transparency regarding our handling of personal information. Should we receive requests from public authorities or other third parties for user data, we will evaluate each request carefully. We are committed to protecting your privacy and will take appropriate measures to ensure that any disclosures are in line with our privacy principles and, where possible, will notify you of such disclosures.

Data Security During Disclosures. When disclosing your Personal Information to third parties as described above, we take steps to protect the confidentiality and security of your data. We strive to use industry-standard safeguards and require third parties to implement similar protections, ensuring your information remains secure throughout any processing.

Links to Third Party Websites

As part of the Platform, we may provide links to or compatibility with other websites or applications. However, we are not responsible for the privacy practices employed by those websites or the information or content they contain. This Privacy Policy applies solely to information collected by us through the Platform. Therefore, this Privacy Policy does not apply to your use of a third-party website accessed by selecting a link on our Platform. To the extent that you access or use the Platform through or on another website or application, then the privacy policy of that other website or application will apply to your access or use of that site or application. We encourage our users to read the privacy statements of other websites before proceeding to use them.

Your Rights Regarding the Use of Your Personal Information

Vzable does not use Account Holder or Learner information for marketing purposes within the platform. However, we may send you administrative or service-related communications that are necessary for your use of the platform, such as account notifications, security alerts, or updates to our Privacy Policy or Terms of Use. Because these communications are integral to the operation and security of the platform, you may not opt out of receiving them while your Account remains active.

Access, Correction, Deletion

We respect your privacy rights and provide you with reasonable access to the Personal Information that you may have provided through your use of the Platform. If you wish to access or amend any other Personal Information we hold about you, or to request that we delete any information about you that we have obtained from our Platform, you may contact us at: info@vzable.com with the email subject as “Personal Information Query.”

At your request, we will have any reference to you deleted or blocked in our database. You may update, correct, or delete your Account information and preferences at any time by accessing your Account settings page on the Platform. Please note that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain all information you submit for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.

You may decline to share certain Personal Information with us, in which case we may not be able to provide to you some of the features and functionality of the Platform.

At any time, you may object to the processing of your Personal Information, on legitimate grounds, except if otherwise permitted by applicable law.

Security of Your Personal Information

We implement security measures designed to protect your information from unauthorized access. Your Account is protected by your Account password and we urge you to take steps to keep your personal information safe by not disclosing your password and by logging out of your account after each use. We further protect your information from potential security breaches by implementing certain technological security measures. Vzable protects User data by using industry-accepted administrative, technical, and physical safeguards designed to secure information against unauthorized access, disclosure, alteration, or destruction. However, these measures do not guarantee that your information will not be accessed, disclosed, altered or destroyed by breach of such firewalls and secure server software. While we use reasonable efforts to protect your Personal Information, we cannot guarantee its absolute security. Vzable maintains a data breach response plan. In the event of a security incident involving your data, Vzable will provide legally required notifications to affected users and, where applicable, to regulators and individuals, in accordance with applicable law. By using our Platform, you acknowledge that you understand and agree to assume these risks.

How Long We Retain Your Data

Vzable retains data from Account Holders and Learner Profiles only for as long as it is needed to fulfill the purpose for which it was collected, or as directed by the Account Holder.

Account Holders may also direct deletion of data at any time, and Vzable will comply with such requests within 30 days of receipt, subject only to legal obligations that require retention for limited purposes such as audit, tax, or compliance.

Reflection response data may be de-identified and retained in aggregate form for research, analytics, and product improvement purposes. Once de-identified, this data can no longer be linked to any individual Learner.

Do Not Track Signals

Certain state laws require us to indicate whether we honor “Do Not Track” settings in your browser. Vzable adheres to the standards set out in this Privacy Policy and does not monitor or follow any Do Not Track browser requests.

Notices

Notice to California Residents. The California Consumer Privacy Act (“CCPA”) provides California consumers with specific rights regarding their Personal Information. You have the right to request that businesses subject to the CCPA: (1) disclose certain information to you about their collection and use of your Personal Information over the past 12 months; (2) delete Personal Information collected from you, subject to certain exceptions; and (3) ask whether the business sells Personal Information and right to opt-out of that sale. To request the above information, you may contact us at: info@vzable.com with the email subject as California Disclosure Information.

California law requires that we provide you with a summary of your privacy rights under the California Online Privacy Protection Act (“California Act”) and the California Business and Professions Code. As required by the California Act, this Privacy Policy identifies the categories of personally identifiable information that we collect through our Platform about individual consumers who use or visit our Platform and the categories of third-party persons or entities with whom such personally identifiable information may be shared.

Notices to International Users. The Platform is hosted in the United States. If you are a User accessing the Platform (or providing information that is hosted on or routed through the Platform) from the European Union (“EU”), Asia, or any other region with laws or regulations governing personal data collection, use, and disclosure, that differ from United States laws, please note that you are transferring your personal data to the United States which does not have the same data protection laws as the EU and other regions, and by providing your personal data you permit the use of your personal data for the uses identified above in accordance with the Privacy Policy.

Changes to This Privacy Policy

We reserve the right to change this policy and our Terms at any time. We will notify you of significant changes to our Privacy Policy by sending a notice to the primary email address specified in your account or by placing a prominent notice on our Platform. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. You should periodically check the Platform and this privacy page for updates.

Contact Information

If you have any questions regarding this Privacy Policy or the practices of the Platform please contact us by sending an email to info@vzable.com.

Last Updated: This Privacy Policy was last updated on May 13, 2026.