Privacy Policy

Welcome to the Prize App ("App"). We value your trust and are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. It also covers our public website, prize.vet — see "Website Visitors, Analytics & Cookies" below for exactly what the website itself collects. By using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

We collect personal information you provide directly, including: • Contact Information: Name, email address, phone number • Account Information: Username, password, profile picture • Military Service Records: Information such as DD-214 if you choose to upload it We also collect usage data (device information, log information, IP address, location information with your permission) and may use cookies and similar tracking technologies.

You may choose to verify your military service through VA.gov, using the U.S. Department of Veterans Affairs ("VA") Veteran Service History and Eligibility API. • Your VA sign-in: You sign in directly with the VA (via VA.gov, ID.me, or Login.gov). Prize never sees or stores your VA.gov, ID.me, or Login.gov credentials. • What we receive: With your authorization, the VA shares a confirmation of your veteran status, your service history (branch of service, service dates, character of discharge), and — only if you use eligibility pre-qualification features — your VA disability rating. • How we use it: To verify your veteran status, pre-fill your military history, and, with your consent, determine whether you meet a resource organization's eligibility requirements. • What we do not do: We do not request ongoing access to your VA records — the access token the VA issues is used once to retrieve the information above and is not stored. We do not receive your Social Security number through this process. We never share raw VA records with resource organizations: organizations see only your verification status, or whether you meet their eligibility requirements, unless you explicitly choose to share more. • Disability rating: We treat your VA disability rating as sensitive information with heightened safeguards (encryption at rest and in transit, restricted access, and audit logging). It is never shared with any organization without your explicit consent. • Your control: Verification through VA.gov is optional, and alternative verification methods are available. You can revoke Prize's access to your VA profile at any time at VA.gov, and you can request deletion of VA-derived information by deleting your account or contacting us. Prize is an independent company and is not affiliated with, endorsed by, or sponsored by the U.S. Department of Veterans Affairs.

We use collected information to: • Provide and maintain the App • Facilitate access to services by connecting you with resource organizations • Communicate with you, send notifications, and provide updates • Improve the App through usage analysis • Ensure security and protect against fraud • Comply with legal obligations Future functionality may include eligibility pre-qualification with your consent.

We do not sell your personal information to third parties. We may share your information only in the following circumstances: • With Resource Organizations (With Your Approval): Only when you explicitly authorize us, and limited to what you choose to share. • With Service Providers: We rely on a limited set of vendors (such as cloud hosting, analytics, and communications) to operate the App. They may access personal data only to perform services for Prize, only on our documented instructions, and are bound by written contracts (including data processing agreements) that require them to: safeguard the data with protections at least as strong as those in this policy; use it solely to provide services to Prize and for no other purpose; not sell it, share it, or use it for their own advertising or profiling; and delete or return it when our engagement ends. We do not authorize any service provider to use your information for its own purposes. • Aggregated and De-Identified Data: Anonymized insights that cannot identify you. • For Legal Reasons: When required by law or to protect rights and security. • Business Transfers: If Prize is involved in a merger, acquisition, financing, or sale of all or part of its assets, your information may be transferred as part of that transaction. If that happens: (1) we will notify you by email and/or in the App before your information becomes subject to a materially different privacy policy; (2) any successor will be required to honor the commitments in this Privacy Policy or give you advance notice of any change; and (3) you will have the opportunity to delete your account and data before the transfer takes effect. We will never sell your personal data as a standalone asset.

We follow data minimization principles and implement strong security measures: • Encryption at rest and in transit • Strict access controls and audit logging • Regular professional penetration testing • Additional safeguards for sensitive data like your DD-214 or VA disability rating We collect only necessary information and share only the minimum required with your approval.

Depending on your jurisdiction, you may have the right to: • Access: Request a copy of your personal data • Correction: Update or correct inaccurate information • Deletion: Request deletion of your personal data. On a verified request, we permanently delete 100% of your personal data — including any VA-derived information — within 45 days (see "Data Retention & Deletion" below) • Opt-Out: Withdraw consent for certain data processing • Additional Rights: Under GDPR or CCPA/CPRA (data portability, restrict processing) To exercise your rights, contact us at prize@prizeapp.io.

This section covers our public website, prize.vet, including the Identity Brief worksheet and our contact and signup forms. • Analytics: We use PostHog, a U.S.-based analytics provider, to understand how visitors use the site — pages viewed, buttons clicked, and general device and browser information. We also collect aggregate interaction patterns (where on a page visitors click, scroll, and move the pointer) to improve page layouts. These are screen coordinates analyzed in aggregate — never the text you type, and never used to identify you. PostHog acts strictly as our service provider under a data processing agreement and may not use this data for its own purposes. Values you type into forms are masked and never collected by analytics. • No session recording: We do not use session-recording or session-replay technology on this website. Your visit is not recorded or watched back. • Browser privacy signals: If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we disable website analytics for your visit entirely and automatically — no banner, no settings required. • Form security (reCAPTCHA): Pages with forms are protected by Google reCAPTCHA Enterprise, which loads only after you begin interacting with the page and is subject to Google's Privacy Policy and Terms of Service. • Form submissions: Information you submit through a form on this website — your name, email, phone number if you provide it, and anything you choose to write — is used only to respond to you and to send the updates you asked for. It is processed by our communications service providers on our behalf, and every email we send includes a working unsubscribe link. • Cookies and similar technologies: The website sets a small number of first-party cookies and browser-storage entries so analytics can distinguish new from returning visits. We do not use third-party advertising cookies, tracking pixels, or cross-site trackers, and we do not sell or share information collected on this website for advertising.

If you are a California resident, the California Consumer Privacy Act (CCPA, as amended by the CPRA) gives you specific rights, and this section is our notice at collection. • Categories of personal information we collect on this website: identifiers (name, email address, and phone number if you provide it); internet or network activity (pages viewed and interactions with the site, as described in Section 8); professional information (your organization's name, if you submit our organizations form); and any information you choose to include in free-text fields. • Sources: directly from you when you fill out a form, and automatically from your browser as described in Section 8. • Purposes: responding to your inquiries, sending updates you request, operating, securing, and improving the website, and preventing spam and fraud. • Retention: form submissions are kept only as long as needed for the purpose you submitted them, and you may request deletion at any time; website analytics data is retained on a rolling basis in our analytics provider's settings. • No sale, no sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we don't, the law does not require a "Do Not Sell or Share My Personal Information" link — and we honor the Global Privacy Control opt-out signal anyway. • Your rights: to know what personal information we have collected about you, to access it, to correct it, to delete it, and to not be discriminated against for exercising any of these rights. To submit a request, email prize@prizeapp.io. You may use an authorized agent; we will verify any request before acting on it, and we will respond within the timeframes the law requires.