Criterica Privacy Policy

1. Who we are

This policy explains how Splitifi, LLC, a Florida limited liability company operating as Criterica Group ("Criterica", "we"), collects, uses, shares and protects information when you use our websites (criterica.com, critericaintelligence.com, critericacapital.com), the Criterica Atlas platform, and our reports and services. Our services are for professional and institutional users.

When a customer uploads information about other people, such as clients, claimants or counterparties, we process it on that customer's behalf, under the Terms of Service.

2. Information we collect

When you register or sign in

• Your name, work email, organization name and role.

• Optional details you choose to give: website, objective, desired outcome, jurisdiction, a referral code, and how you found us.

• A password, which we store only as a secure hash. You can sign in with Google instead.

• The terms and permissions you accept, with the exact version, the time, your IP address and your browser user agent.

• For sign-in attempts, the email address used, the IP address and whether the attempt succeeded, kept for security.

What you submit to Atlas ("Customer Materials")

• Submission details, such as a description, asset class, jurisdiction, amounts, counterparties and contacts.

• Documents you upload, and answers to our information requests.

• Portfolio files ("tapes"), up to 500 rows per file, including any columns you include.

Customer Materials often contain information about other people, such as claimant names, case numbers, incident dates, law firms, insurers and amounts. They may also contain sensitive information, such as medical records, medical lien and treatment details, dates of birth or phone numbers (see section 6).

Payments

• Payments are taken by Stripe, on Stripe's own checkout page. We never receive or store full card numbers.

• We keep the payment and subscription records Stripe sends us: identifiers, amounts, status and the event details.

Website inquiries

• When you contact us through one of our websites, we keep your name, email, organization, title, your message and how you found us.

Cookies and analytics

• We use first-party cookies only. They cover:

  • keeping you signed in;

  • remembering your time zone and the organization you are working in;

  • a random visitor identifier (one year);

  • how you reached our sign-up page (30 days);

  • continuing a sign-up in the same browser.

• We use no third-party analytics, advertising cookies or tracking pixels.

• Our product usage records hold identifiers, event types and figures such as order amounts, not the content of your documents.

Security and activity records

• We record important actions in Atlas, such as changes, deletions, staff downloads and sign-ins. Some of these records include your IP address.

• File downloads are recorded with hashed, not raw, address details.

3. Court record data

Criterica's research database is built from public court filings. It contains public record information, such as party names, case numbers, docket entries and outcomes, as they appear in official filings. We do not use it to build consumer profiles or to make credit decisions about individuals.

4. How we use information

Service processing. We use information to:

• provide the services you request: analysing submissions, preparing and delivering reports, and running your workspace;

• keep the services secure;

• bill you and administer your account;

• keep audit records;

• send the messages the service needs, such as confirmations, delivery notices and security notices;

• give support;

• meet our legal obligations.

Not without your separate permission. We do not use Customer Materials to train or improve generalized predictive or generative models, and we do not license them, sell them, or share them with other customers. Doing any of these needs a separate, specific permission in Atlas or a written agreement. Accepting our Terms does not give it.

Marketing. We send product and research updates only if you opt in, and you can withdraw at any time.

Reports and estimates. Atlas produces estimates and reports from your materials and from public records. They are statistical outputs, not decisions about any individual.

5. When we share information

Our service providers. These providers process information on our behalf, under contract:

These are the providers that receive customer information today. Atlas does not currently send customer materials to any separate scoring or AI service. If we add a provider, or a service of our own outside Atlas, that receives personal information, we will update this list before it does.

Public-record lookups. To check a case against public court records, we may send a case number, party, attorney, business or principal names to CourtListener, a public court-records service.

Capital providers, only with your permission.

• A capital provider sees a submission only after you permit that named provider, for that submission.

• Even then, it sees only the summary fields shown to you: title, asset class, venue, an amount band, description and your organization name.

• A provider receives a document only when you share that document with that provider.

• You can withdraw permission at any time. The provider then loses access in Atlas. Information it has already seen cannot be recalled.

Partners you connect to. If you connect an integration or set up a webhook, we send it the information that integration needs, as you configure it.

Legal and corporate. We may disclose information when the law, a court order or a regulator requires it, or to protect rights and safety. Information may also move as part of a merger or sale of our business, subject to this policy.

We do not sell personal information.

6. Sensitive and medical information

• Customer Materials can include medical and other sensitive information. A personal-injury file, for example, often contains medical records. We use that information only for service processing, under section 4. We ask customers to submit only what the service they request needs.

• Information from attorneys or claimants. When an attorney, a law firm, a claimant or another customer gives us medical information about a claim, we process it for that customer under these terms and this policy.

• Information on behalf of healthcare entities. Where we would act on behalf of a HIPAA covered entity or its business associate, for example by processing records for a healthcare provider's medical receivables, a business associate agreement is required. That service is not offered until one is in place.

Consumer health data (individual claimant accounts, once offered). Individual claimant accounts are not yet available. Organization accounts are not subject to this part. When individual accounts are offered, the following will apply before any individual can upload health information:

• If you open an individual account and upload your own medical records or health information, we treat it as consumer health data.

• Before any upload, we show a consumer health-data notice and ask for your separate consent. That notice says what we collect, why, who receives it, and how to withdraw consent and have it deleted.

• We use it only for the service you request. We do not sell it, and we share it with a capital provider only with your specific permission for that provider.

• You can withdraw consent and ask for deletion at any time at privacy@criterica.com.

• These protections follow the consumer health-data laws that apply where you live, including Washington's My Health My Data Act and similar laws in Nevada and Connecticut.

7. Duplicate and same-claim checks

To protect customers and capital providers from duplicate or conflicting claims, we screen claims for integrity.

• How the check works. Atlas keeps a one-way coded key for each claim, made from a few identity details such as name, date of birth and incident date. The key is used to spot when the same claim appears more than once. It cannot be turned back into those details.

• Within your organization, linked records are shown to you.

• Across organizations, a possible match only starts an internal review by authorized Criterica staff. A match never shows another organization its underlying documents, its customer's identity, or its case details. It never notifies another customer, and records are never merged.

• Why we do it. We use the check only to screen for integrity, where we are lawfully permitted to, and keep each organization's workspace separate.

8. How we protect information

• Customer files are kept in private storage and served by our servers. Downloads in Atlas go through a one-time link that expires after five minutes. Downloads through our API require your API credentials.

• Passwords are stored only as secure hashes.

• In transit, information is encrypted between your browser and our services.

• Access to an organization's workspace is limited to that organization's users. A request for another organization's records returns nothing.

• Criterica staff who can see customer materials are named staff with an administrative role. They can review a customer's submissions only while that customer's processing permission is active, and for orders a customer places, they see what is needed to deliver them. Staff downloads and changes are logged.

No method of storage or transmission is completely secure.

9. How long we keep information

What these periods cover, and what they don't. These periods apply to the records named. Deleting your files does not delete records we must keep, which are held on their own schedules:

• financial and payment records (for accounting and tax);

• consent and acceptance histories;

• security and audit trails;

• records under a legal hold or preservation obligation;

• records we must keep by law.

When we delete a submission, we delete its files and content, and keep a deletion receipt and the records listed above.

10. Your rights

You can ask to access, correct, export or delete your personal information, or object to or restrict how we use it, at privacy@criterica.com.

• We respond within 30 days.

• Where we process information on a customer's behalf, for example a claimant named in a customer's file, we will refer the request to that customer and help them answer it.

• We do not treat you differently for using these rights.

• Depending on where you live, including Canada (PIPEDA and provincial law), you may have further rights.

11. Children

Our services are for professionals and institutions. We do not knowingly collect information from anyone under 18.

12. Changes to this policy

• We will post any update with its new effective date.

• For a material change, we will tell registered users by email or in Atlas, and where we require it, ask you to accept the new version.

• A change that widens how we may use or share Customer Materials needs your active acceptance. It never applies to materials submitted before you accepted it.

13. Contact

privacy@criterica.com · Splitifi, LLC, a Florida limited liability company, Palm Beach, Florida. Criterica Group is a Splitifi company.