1. INTRODUCTION

VetForge, Inc. ("VetForge," "we," "us," or "our") is a veteran-focused Software-as-a-Service (SaaS) platform headquartered in the United States. Our platform is purpose-built to serve veterans, transitioning service members, and military-affiliated individuals by providing career transition management tools, VA and military benefits tracking, professional development resources, resume building, and employment matching services.

This Privacy Policy ("Policy") describes how VetForge collects, uses, stores, shares, and protects information about you ("User," "you," or "your") when you access or use the VetForge platform, website, mobile applications, and related services (collectively, the "Services"). This Policy applies to all users of the Services, regardless of how you access them.

By creating an account or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described here, please do not use the Services.

1.1 Our Commitment to the Veteran Community

We recognize that members of the veteran and military community have made extraordinary sacrifices in service to the United States. The individuals who use VetForge may share deeply personal information — including military service histories, disability ratings, and benefits status — in order to receive the support they have earned. We treat this responsibility seriously. VetForge is committed to handling all user data, especially service-related and health-adjacent information, with the utmost care, discretion, and respect.

1.2 Scope of This Policy

This Policy covers all information collected through the VetForge platform and associated digital properties. It does not govern the privacy practices of third-party websites, government portals (such as VA.gov or DoD systems), or external employers and job boards accessible via links within the platform. We encourage you to review the privacy policies of those third parties separately.

2. INFORMATION WE COLLECT

VetForge collects information you provide directly, information generated through your use of the platform, and limited information from third-party sources where you have authorized such sharing. We collect only the information necessary to provide and improve our Services.

2.1 Personal Identification Information

When you register for an account or use our Services, we may collect the following identifying information:

• Full legal name
• Email address
• Phone number
• Mailing address or residential zip code
• Date of birth (for age verification and benefits eligibility purposes)
• Username and account credentials (stored in encrypted form)
• Profile photo (if voluntarily uploaded)

2.2 Military and Service Information

To help personalize your career transition and benefits guidance, VetForge may ask you to optionally provide:

• Branch of military service (e.g., Army, Navy, Marine Corps, Air Force, Space Force, Coast Guard)
• Military Occupational Specialty (MOS), rate, or Air Force Specialty Code (AFSC)
• Dates of service (entry and separation dates)
• Rank at separation
• Discharge status and characterization of service
• Whether you served on active duty, in the Reserve, or in the National Guard
• Combat deployments or theater of service (voluntary)
• Security clearance level (if relevant to job matching — never shared without explicit consent)
• Veteran status designations (e.g., disabled veteran, Purple Heart recipient)

2.3 Professional and Career Data

To provide career matching, resume building, and professional development services, we collect:

• Resume content and work history
• Civilian and military employment history
• Professional certifications, licenses, and credentials
• Educational background (degrees, institutions, dates)
• Skills assessments and competency profiles
• Career goals and job preferences
• Completed training modules and professional development progress within the platform

2.4 Benefits and Financial Data

If you choose to use our benefits tracking tools, you may voluntarily provide:

• VA disability rating percentage
• Types of VA benefits received or applied for (e.g., education benefits under GI Bill, home loan guaranty, pension)
• Claims status information you manually enter
• Monthly benefit compensation amounts (for financial planning tools)
• TRICARE or other military health plan information (voluntarily provided)

VetForge does not collect Social Security numbers, bank account numbers, tax information, or payment card data through the benefits tracking feature.

2.5 Usage and Technical Data

Like all web-based platforms, VetForge automatically collects certain technical information when you interact with the Services:

• Internet Protocol (IP) address
• Browser type, version, and language settings
• Operating system and device type
• Device identifiers and unique advertising identifiers (where applicable)
• Pages visited, features used, and time spent within the platform
• Referring URLs (the page you came from before visiting VetForge)
• Log data, error logs, and diagnostic information
• Cookie identifiers and session tokens (see Section 9)

2.6 Communications Data

When you contact us or interact with our team, we collect:

• Content of support tickets, chat messages, and emails sent to VetForge
• Records of correspondence for quality assurance and dispute resolution purposes
• Survey responses and feedback you voluntarily provide
• Records of notifications sent to you and your response status (opened, unsubscribed)

3. HOW WE USE YOUR INFORMATION

VetForge uses collected information only for the purposes described in this Policy. We apply the principle of data minimization — using only what is necessary to fulfill each stated purpose.

3.1 Providing and Improving the Platform

• Creating and managing your user account
• Delivering career transition tools, benefits tracking dashboards, and professional development features
• Processing your inputs and generating platform outputs (e.g., resume suggestions, job matches, benefits summaries)
• Diagnosing and resolving technical issues, bugs, and service disruptions
• Improving platform features, user experience, and functionality based on aggregated usage data

3.2 Personalizing Veteran Career and Benefits Guidance

• Matching your military occupational skills to civilian career opportunities
• Tailoring benefits guidance and resources to your service history and eligibility profile
• Recommending relevant certifications, training programs, and professional development content
• Surfacing job postings and employer partners aligned with your background and preferences

3.3 Service Notifications and Communications

• Sending transactional emails related to your account (registration confirmations, password resets, security alerts)
• Notifying you of updates to your benefits tracking or application status
• Providing platform announcements, feature updates, and policy changes
• Sending optional newsletters or veteran community updates — only with your consent and always with an opt-out mechanism (see Section 8.3)

3.4 Analytics and Platform Performance

• Analyzing aggregated, anonymized usage patterns to improve platform design and feature prioritization
• Monitoring platform stability, load performance, and security posture
• Conducting internal research to better understand the needs of the veteran community we serve

3.5 Legal Compliance and Fraud Prevention

• Complying with applicable federal, state, and local laws and regulations
• Detecting, investigating, and preventing unauthorized access, fraud, and abuse of the platform
• Enforcing our Terms of Service and other applicable agreements
• Cooperating with lawful government or law enforcement requests as required

4. HOW WE SHARE YOUR INFORMATION

VetForge shares user information only in the limited circumstances described below. We do not share personal information with commercial advertisers under any circumstances.

4.1 Service Providers and Vendors

We engage trusted third-party vendors to help operate and improve our platform. These vendors are permitted to process your data only as instructed by VetForge and for no other purpose. All vendors with access to personal data are required to execute Data Processing Agreements (DPAs) that impose obligations consistent with this Policy. Categories of vendors include:

• Cloud hosting and infrastructure providers
• Identity verification and authentication services
• Email delivery and communications platforms
• Anonymized analytics providers
• Customer support and ticketing systems
• Cybersecurity and monitoring services

4.2 Legal Obligations and Government Requests

VetForge may disclose information when we have a good-faith belief that disclosure is necessary to:

• Comply with a valid legal process, court order, subpoena, or binding governmental request
• Enforce our Terms of Service or protect the rights and property of VetForge
• Protect the personal safety of users of the Services or members of the public
• Investigate or prevent fraud, security incidents, or illegal activity

Where permitted by law, we will notify affected users of government requests for their data prior to disclosure.

4.3 Business Transfers

In the event that VetForge undergoes a merger, acquisition, asset sale, reorganization, or bankruptcy proceeding, your information may be transferred to a successor entity as part of that transaction. In any such event, VetForge will provide notice to affected users prior to the transfer of personal data, and the successor entity will be required to honor the commitments in this Policy or provide users with the opportunity to delete their accounts before the transfer takes effect.

4.4 With Your Explicit Consent

We may share your information with third parties in circumstances not described above when you have provided clear, affirmative, informed consent to that specific sharing. For example, if you choose to share your VetForge profile with a specific employer or benefits counselor through a platform feature, that sharing occurs only upon your direct instruction and authorization.

4.5 No Sharing with Commercial Advertisers

VetForge does not share personal data with advertisers, advertising networks, data brokers, or marketing analytics platforms. Your profile, service history, benefits data, and career information are never used for targeted advertising — by VetForge or any third party acting on our behalf.

5. DATA RETENTION

VetForge retains personal data for as long as necessary to fulfill the purposes described in this Policy, to maintain your active account, and to comply with applicable legal, regulatory, or contractual obligations. The following table summarizes our standard retention periods by data category:

5.1 Account Deletion

You may request deletion of your VetForge account and associated personal data at any time by submitting a request to privacy@vetforge.io or through the account settings page. Upon verified receipt of a deletion request, VetForge will:

1. Initiate deletion of your personal data from active systems within 30 days;
2. Remove your data from backup systems within 90 days of the deletion request;
3. Confirm completion of deletion to you via email.

Certain information may be retained beyond these periods where required by law (e.g., financial transaction records, fraud investigation records, or legal hold obligations). Where such retention is required, the data will be isolated and not used for any ongoing operational purpose.

5.2 Anonymization

Where deletion is not immediately required, VetForge may anonymize personal data in lieu of deletion. Anonymized data — from which all personally identifiable information has been irreversibly removed — may be retained indefinitely for aggregate research, platform improvement, and statistical analysis purposes. Anonymized data is not subject to this Policy.

6. DATA SECURITY

VetForge implements administrative, physical, and technical safeguards designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Given the sensitivity of the data our users share, we prioritize security as a core operational requirement, not an afterthought.

6.1 Encryption Standards

• Data at rest: All personal data stored in VetForge systems is encrypted using AES-256 (Advanced Encryption Standard with 256-bit key length), the same standard used by U.S. federal agencies for protecting sensitive information.
• Data in transit: All data transmitted between your device and VetForge servers is protected using TLS 1.2 or higher (Transport Layer Security), ensuring that data cannot be intercepted during transmission.
• Passwords: User passwords are never stored in plain text. They are hashed and salted using industry-standard cryptographic algorithms.

6.2 Access Controls

• Access to personal data is restricted on a need-to-know basis using role-based access controls (RBAC).
• All VetForge employees and contractors with access to production data systems are subject to background checks and security training.
• Multi-factor authentication (MFA) is required for all internal VetForge system access.
• Access logs are maintained and reviewed for anomalous activity.

6.3 SOC 2 Compliance Posture

VetForge is actively pursuing and maintaining alignment with the SOC 2 Type II framework (Service Organization Control), which establishes standards for security, availability, processing integrity, confidentiality, and privacy of customer data. Our security controls are designed to satisfy the Trust Services Criteria established by the American Institute of Certified Public Accountants (AICPA). Current SOC 2 audit status is available upon request for enterprise customers and authorized stakeholders.

6.4 Incident Response

VetForge maintains a documented data breach and incident response plan. In the event of a security incident that affects your personal data:

1. We will assess the nature and scope of the incident within 72 hours of discovery;
2. We will notify affected users without undue delay as required by applicable law;
3. We will notify relevant regulatory authorities where legally required;
4. We will take prompt remediation steps to contain and mitigate the impact of the incident.

6.5 Limitations of Security Guarantees

While VetForge employs industry-standard security measures, no method of electronic data transmission or storage is 100% secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and for immediately notifying us at privacy@vetforge.io if you suspect unauthorized access to your account.

7. YOUR RIGHTS AND CHOICES

VetForge respects your rights regarding your personal data. Regardless of where you are located, we provide the following baseline rights to all users. Additional rights may apply based on your state or country of residence, as described below.

7.1 Universal User Rights

1. Right to Access. You may request a copy of the personal data we hold about you, including the categories of data collected, the purposes of processing, and any third parties with whom it has been shared.
2. Right to Correction. You may request that we correct inaccurate or incomplete personal data. Many data fields can be updated directly within your account settings.
3. Right to Deletion. You may request that we delete your personal data, subject to limited exceptions required by law (see Section 5.1).
4. Right to Data Portability. You may request a machine-readable export of your personal data in a commonly used format (such as JSON or CSV) so that you can transfer it to another service provider.
5. Right to Restrict Processing. In certain circumstances, you may request that we limit how we process your data while a dispute or correction request is pending.
6. Right to Object. You may object at any time to processing of your personal data for direct marketing purposes. You may also object to certain other types of processing on grounds relating to your particular situation.

7.2 Opt-Out of Marketing Communications

You may opt out of non-essential marketing or newsletter communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email from VetForge;
• Adjusting notification preferences in your account settings; or
• Contacting us directly at privacy@vetforge.io with the subject line "Marketing Opt-Out."

Please note that even if you opt out of marketing communications, you will continue to receive essential transactional and security notifications related to your account.

7.3 Cookie Preferences

You may manage cookie preferences through our Cookie Preference Center, accessible via the cookie consent banner displayed upon first visit to the VetForge platform. You may also configure cookie preferences through your browser settings. Please note that disabling certain cookies may limit the functionality of some platform features. See Section 9 for full details.

7.4 California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights:

1. Right to Know. You have the right to know what personal information we collect, use, disclose, and sell (we do not sell personal information).
2. Right to Delete. You have the right to request deletion of personal information we have collected about you.
3. Right to Correct. You have the right to request correction of inaccurate personal information.
4. Right to Opt-Out of Sale or Sharing. VetForge does not sell or share personal information for cross-context behavioral advertising. No opt-out action is required, but you may submit a "Do Not Sell or Share My Personal Information" request to privacy@vetforge.io for our records.
5. Right to Non-Discrimination. VetForge will not discriminate against you for exercising any CCPA rights. We will not deny services, charge different prices, or provide a different level of service based on your exercise of privacy rights.
6. Right to Limit Use of Sensitive Personal Information. You may direct us to limit our use of sensitive personal information (including military service data) to purposes necessary to provide the Services.

To submit a CCPA request, contact us at privacy@vetforge.io with the subject line "CCPA Privacy Request." We may need to verify your identity before processing the request.

7.5 EU and EEA Residents — GDPR Rights

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) applies to our processing of your personal data. You have the following rights under the GDPR:

1. Right of Access (Article 15). Obtain confirmation of whether we process your data and a copy of that data.
2. Right to Rectification (Article 16). Have inaccurate data corrected without undue delay.
3. Right to Erasure (Article 17). Request deletion of your data ("right to be forgotten") under applicable circumstances.
4. Right to Restriction of Processing (Article 18). Restrict processing of your data in certain circumstances.
5. Right to Data Portability (Article 20). Receive your data in a structured, commonly used, machine-readable format.
6. Right to Object (Article 21). Object to processing based on legitimate interests or for direct marketing purposes.
7. Right to Lodge a Complaint. You have the right to lodge a complaint with your national Data Protection Authority (DPA) if you believe we have violated your GDPR rights.

Our lawful bases for processing personal data under the GDPR include: performance of a contract (providing the Services), legitimate interests (platform security and fraud prevention), compliance with legal obligations, and consent (for optional data categories and marketing communications).

For GDPR-related inquiries, contact our Data Protection Officer (DPO) at dpo@vetforge.io.

7.6 How to Submit a Privacy Rights Request

8. COOKIES AND TRACKING TECHNOLOGIES

VetForge uses cookies and similar tracking technologies (collectively, "cookies") to operate the platform, remember your preferences, and understand how users interact with our Services.

8.1 Types of Cookies We Use

8.2 Third-Party Analytics

VetForge may use third-party analytics providers to help us understand platform usage patterns. Any analytics tools we employ are configured to operate in anonymized or pseudonymized mode — meaning individual users cannot be identified from the analytics data collected. We do not permit analytics providers to use VetForge user data for their own purposes beyond providing analytics services to us.

VetForge does not use advertising cookies, cross-site tracking cookies, or third-party retargeting technologies.

8.3 Opt-Out Mechanisms

You may manage non-essential cookie preferences at any time through:

• The Cookie Preference Center accessible from the footer of any VetForge page;
• Your browser settings — most browsers allow you to block or delete cookies. Please consult your browser's help documentation for instructions;
• The Network Advertising Initiative opt-out tool at optout.networkadvertising.org (though VetForge does not use advertising networks); or
• The Digital Advertising Alliance opt-out at optout.aboutads.info.

Note: Disabling strictly necessary cookies will impair your ability to log in and use core platform features.

9. THIRD-PARTY LINKS AND SERVICES

The VetForge platform may contain links to third-party websites, government portals, and external resources that are provided for your convenience and reference. These may include, but are not limited to:

• VA.gov and other U.S. Department of Veterans Affairs resources
• U.S. Department of Defense (DoD) portals and transition assistance resources
• External job boards, career fairs, and employer websites
• Professional credentialing and certification bodies
• Veteran Service Organizations (VSOs) and nonprofit resources

10. CHILDREN'S PRIVACY

The VetForge platform is designed for adults, specifically veterans, transitioning service members, and military-affiliated individuals who are at least 18 years of age. VetForge is not directed at, and does not knowingly collect personal information from, individuals under the age of 18.

If we become aware that we have inadvertently collected personal information from a user under the age of 18, we will take prompt steps to delete such information from our systems. If you are a parent or guardian and you believe your minor child has provided personal information to VetForge without your consent, please contact us immediately at privacy@vetforge.io and we will address your concern without undue delay.

VetForge complies with the Children's Online Privacy Protection Act (COPPA) and does not knowingly solicit or collect data from children under 13 under any circumstances.

11. CHANGES TO THIS POLICY

VetForge reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, platform features, applicable laws, or industry standards. All changes will be posted on this page with an updated "Effective Date" at the top of the document.

11.1 Notification of Material Changes

For material changes — those that significantly affect your rights or how we process your data — VetForge is committed to providing at least 30 days' advance notice before the changes take effect. Notification will be provided via:

• A prominent banner or notification displayed within the VetForge platform;
• An email notification sent to the email address associated with your account; and
• A summary of key changes posted on the VetForge Privacy Policy page.

11.2 Your Continued Use

Your continued use of the VetForge platform following the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you may request deletion of your account before the new policy takes effect by contacting us at privacy@vetforge.io.

11.3 Policy Archive

Prior versions of this Privacy Policy are archived and available upon request. To obtain a copy of a previous version, contact us at privacy@vetforge.io with the subject line "Privacy Policy Archive Request."

12. CONTACT INFORMATION

If you have questions, concerns, or requests relating to this Privacy Policy or VetForge's data practices, please do not hesitate to contact us. We are committed to addressing all privacy inquiries promptly and transparently.

12.1 Privacy Team

12.2 Regulatory Authorities

If you believe VetForge has not addressed your privacy concern adequately, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction:

• United States (Federal): Federal Trade Commission (FTC) — ftc.gov/privacy
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov
• European Union / EEA: Your national Data Protection Authority (DPA) — a full list is available at edpb.europa.eu

We value your trust and encourage you to reach out to VetForge directly before escalating to a regulatory authority, as we are committed to resolving concerns at the first point of contact.