Privacy Policy

Welcome to the Prize App ("App"). We value your trust and are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. By using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

We collect personal information you provide directly, including: • Contact Information: Name, email address, phone number • Account Information: Username, password, profile picture • Military Service Records: Information such as DD-214 if you choose to upload it We also collect usage data (device information, log information, IP address, location information with your permission) and may use cookies and similar tracking technologies.

You may choose to verify your military service through VA.gov, using the U.S. Department of Veterans Affairs ("VA") Veteran Service History and Eligibility API. • Your VA sign-in: You sign in directly with the VA (via VA.gov, ID.me, or Login.gov). Prize never sees or stores your VA.gov, ID.me, or Login.gov credentials. • What we receive: With your authorization, the VA shares a confirmation of your veteran status, your service history (branch of service, service dates, character of discharge), and — only if you use eligibility pre-qualification features — your VA disability rating. • How we use it: To verify your veteran status, pre-fill your military history, and, with your consent, determine whether you meet a resource organization's eligibility requirements. • What we do not do: We do not request ongoing access to your VA records — the access token the VA issues is used once to retrieve the information above and is not stored. We do not receive your Social Security number through this process. We never share raw VA records with resource organizations: organizations see only your verification status, or whether you meet their eligibility requirements, unless you explicitly choose to share more. • Disability rating: We treat your VA disability rating as sensitive information with heightened safeguards (encryption at rest and in transit, restricted access, and audit logging). It is never shared with any organization without your explicit consent. • Your control: Verification through VA.gov is optional, and alternative verification methods are available. You can revoke Prize's access to your VA profile at any time at VA.gov, and you can request deletion of VA-derived information by deleting your account or contacting us. Prize is an independent company and is not affiliated with, endorsed by, or sponsored by the U.S. Department of Veterans Affairs.

We use collected information to: • Provide and maintain the App • Facilitate access to services by connecting you with resource organizations • Communicate with you, send notifications, and provide updates • Improve the App through usage analysis • Ensure security and protect against fraud • Comply with legal obligations Future functionality may include eligibility pre-qualification with your consent.

We do not sell your personal information to third parties. We may share your information only in the following circumstances: • With Resource Organizations (With Your Approval): Only when you explicitly authorize us, and limited to what you choose to share. • With Service Providers: We rely on a limited set of vendors (such as cloud hosting, analytics, and communications) to operate the App. They may access personal data only to perform services for Prize, only on our documented instructions, and are bound by written contracts (including data processing agreements) that require them to: safeguard the data with protections at least as strong as those in this policy; use it solely to provide services to Prize and for no other purpose; not sell it, share it, or use it for their own advertising or profiling; and delete or return it when our engagement ends. We do not authorize any service provider to use your information for its own purposes. • Aggregated and De-Identified Data: Anonymized insights that cannot identify you. • For Legal Reasons: When required by law or to protect rights and security. • Business Transfers: If Prize is involved in a merger, acquisition, financing, or sale of all or part of its assets, your information may be transferred as part of that transaction. If that happens: (1) we will notify you by email and/or in the App before your information becomes subject to a materially different privacy policy; (2) any successor will be required to honor the commitments in this Privacy Policy or give you advance notice of any change; and (3) you will have the opportunity to delete your account and data before the transfer takes effect. We will never sell your personal data as a standalone asset.

We follow data minimization principles and implement strong security measures: • Encryption at rest and in transit • Strict access controls and audit logging • Regular professional penetration testing • Additional safeguards for sensitive data like your DD-214 or VA disability rating We collect only necessary information and share only the minimum required with your approval.

Depending on your jurisdiction, you may have the right to: • Access: Request a copy of your personal data • Correction: Update or correct inaccurate information • Deletion: Request deletion of your personal data. On a verified request, we permanently delete 100% of your personal data — including any VA-derived information — within 45 days (see "Data Retention & Deletion" below) • Opt-Out: Withdraw consent for certain data processing • Additional Rights: Under GDPR or CCPA/CPRA (data portability, restrict processing) To exercise your rights, contact us at prize@prizeapp.io.