Cookie & Tracking Technologies Policy

This Cookie & Tracking Technologies Policy ("Policy") explains how Sero LLC, a Florida limited liability company, doing business as "exeral" ("exeral", "we", "us", or "our"), uses cookies and similar tracking technologies on our public website at exeral.io and on our client portal and related online services (together, the "Site").

This Policy is incorporated into and forms part of our Website Terms of Use (the "Terms") and should be read together with our Privacy Policy. Our Privacy Policy is the controlling instrument for all matters concerning the collection, use, sharing, and protection of personal data, including how we handle information received from Google APIs, voice and call-recording disclosures, email and SMS communications, our cold-outreach lead program, data retention, and your privacy rights. This Policy controls only as to the specific mechanics of cookies and similar technologies described here; if any conflict arises on a personal-data matter, the Privacy Policy governs. The Terms govern the legal relationship between you and exeral, including the governing-law, venue, dispute-resolution, and limitation-of-liability provisions described in Section 11.

By using the Site, you accept the strictly necessary cookies described below, which are required to operate the Site, and you agree to the Terms. Continued use of the Site indicates acceptance of strictly necessary cookies only; it does not by itself constitute consent to any non-essential cookies. Where applicable law requires consent before non-essential cookies are placed, we will obtain that consent as described in Section 7.

1. What Cookies and Tracking Technologies Are

A "cookie" is a small text file that a website places on your device (computer, phone, or tablet) when you visit. Cookies let a site recognize your browser, remember information about your visit, keep you signed in, and understand how the Site is used.

This Policy also covers other technologies that work like cookies, including:

• Local storage and session storage — data stored by your browser that a site can read and write (for example, to remember preferences or keep you logged in).
• Pixels, tags, and web beacons — tiny files or snippets of code that can record that a page was loaded.
• Software development kits (SDKs) and scripts — code from us or our service providers that runs on the Site to provide features, security, or analytics.

In this Policy, we use the word "cookies" as shorthand for cookies and all of these similar technologies, unless we say otherwise.

Cookies may be:

• First-party — set by exeral or our Site directly; or
• Third-party — set by a service provider or other company whose technology we use on the Site (for example, an analytics or authentication provider).

Cookies may also be:

• Session cookies — temporary; deleted when you close your browser; or
• Persistent cookies — remain on your device until they expire or you delete them.

2. Why We Use Cookies

We use cookies to:

• operate and secure the Site, including signing you in to the client portal and keeping your session active;
• remember your settings and preferences;
• understand how visitors find and use the Site so we can measure and improve performance;
• protect against fraud, abuse, and security threats; and
• support the features you ask us to provide.

We do not use the cookies described in this Policy to build advertising profiles about you for cross-context behavioral advertising, and we do not sell the information that our Site cookies collect. See Section 8. This statement concerns information collected through cookies and similar technologies on the Site only; our broader privacy practices, including any information collected outside the Site, are described in our Privacy Policy.

3. Categories of Cookies We Use

We group cookies into the categories below. Whether a particular cookie is actually present can change over time as we add, remove, or update features and service providers. Section 4 lists representative examples; because cookie names and durations set by third parties change frequently, some entries use bracketed placeholders.

3.1 Strictly Necessary Cookies (always active)

These cookies are essential for the Site to function and cannot be switched off in our systems. They are typically set in response to actions you take, such as logging in, submitting a form, or setting privacy preferences. Without these cookies, core parts of the Site — especially the client portal — will not work. Because they are essential, we do not require consent for these cookies.

Examples of what strictly necessary cookies do:

• Authentication and session management — keep you securely signed in to the client portal across its three sign-in methods (passwordless magic link, Google sign-in, and email-and-password). Our authentication provider (Supabase) sets and reads cookies and/or local storage tokens for this purpose. Google sign-in is used solely to authenticate you to the portal; our use of information received from Google in connection with sign-in and any Google data scopes is described in our Privacy Policy.
• Security — help detect and prevent fraudulent activity, protect against cross-site request forgery, and maintain the integrity of your session.
• Load balancing and core platform functions — provided by our hosting platform (Vercel) so the Site loads reliably.
• Consent state — remember your cookie choices where a consent mechanism is in use.

3.2 Functional / Preferences Cookies

These cookies let the Site remember choices you make and provide enhanced, more personal features (for example, remembering form entries you started, your preferred display settings, or a partially completed intake). They are not strictly necessary, but they improve your experience. If you block these, some convenience features may not work as intended.

3.3 Analytics / Performance Cookies

These cookies help us understand how the Site is used — which pages are visited, how visitors arrive, and where they encounter problems — so we can measure and improve performance. The information is used in aggregate. We use analytics and performance tools that may include Google Analytics (GA4) and/or Google Tag Manager and our hosting platform's built-in analytics (Vercel). Some of these tools set their own cookies or identifiers.

These are non-essential cookies. At present, we set analytics cookies without first obtaining your opt-in consent, because no law currently applicable to exeral requires opt-in consent before placing them. Where we have configured a provider's controls to do so, we limit data sharing for advertising purposes; the configuration of any given provider may change over time. As we deploy a consent mechanism or expand into jurisdictions that require prior consent or an opt-out for these technologies, we will provide the controls described in Sections 6 and 7. Data derived from analytics is retained in accordance with the retention approach described in our Privacy Policy.

3.4 Advertising / Measurement Technologies

We do not currently run third-party advertising or retargeting pixels (such as social-media advertising pixels) on the Site, and we do not engage in cross-context behavioral advertising. If this changes in the future, we will update this Policy, identify the relevant technologies in the table in Section 4, and — where required by law — obtain your consent and provide an opt-out before such trackers are activated.

A note about email-marketing pixels. As described in our Privacy Policy, exeral operates outreach and transactional email programs (using a provider such as Resend) that may include tracking pixels in emails to measure delivery and opens. Those pixels operate within email messages, not on this Site, and are therefore not "cookies" placed by the Site. They are mentioned here only for transparency. We do not use information from email tracking to serve advertising to you. How we handle email communications, opt-outs, and unsubscribe requests, and our compliance with applicable email laws, is described in our Privacy Policy.

4. Examples of Cookies We May Use

The following table is illustrative. Because third parties frequently change cookie names, purposes, and durations, and because our feature set evolves, the exact cookies present on your device at any time may differ. Where a specific name or duration is not fixed, we use a bracketed placeholder.

We do not currently use Google Analytics, Google Tag Manager, Vercel Analytics, or any advertising/retargeting cookies. If we add analytics or advertising tools that set non-essential cookies, we will list them here and load them only after you opt in through our consent banner.

If you would like a current, automatically generated list of the specific cookies in use on the Site, please contact us at privacy@exeral.io.

5. How Long Cookies Last

• Session cookies are deleted automatically when you close your browser.
• Persistent cookies remain until they expire (see the "Duration" column in Section 4) or until you delete them through your browser.

Where a third party sets a cookie, that third party controls its duration; the durations shown above are typical values published by those providers and may change. The retention of data derived from cookies (for example, analytics records) is addressed in the retention section of our Privacy Policy.

6. How You Can Control Cookies

You have several ways to control or remove cookies. Please note that blocking strictly necessary cookies will prevent core features — including signing in to the client portal — from working.

6.1 Browser Settings

Most browsers let you view, manage, block, and delete cookies through their settings. Look for "Privacy," "Cookies," or "Site data" in your browser's menu. You can usually set your browser to refuse some or all cookies, or to alert you when a cookie is being set. Instructions are available in your browser's help documentation. Because settings are device- and browser-specific, you will need to repeat your choices on each browser and device you use.

6.2 Opt-Out Tools for Analytics

• Google Analytics: You can opt out of Google Analytics across websites by installing Google's browser add-on, available at https://tools.google.com/dlpage/gaoptout, and you can review Google's practices at https://policies.google.com/technologies/partner-sites.

6.3 Opt-Out Preference Signals (including Global Privacy Control)

Some browsers and extensions can send an opt-out preference signal, such as Global Privacy Control (GPC). As explained in Section 8, we do not currently sell or share personal information or engage in targeted advertising or cross-context behavioral advertising through the Site, so there is presently nothing to opt out of by means of such a signal. If and when we deploy technologies that constitute a "sale" or "share" of personal information or targeted advertising as defined under applicable law, we will honor recognized opt-out preference signals to the extent required by that law and will describe the mechanism in our Privacy Policy.

6.4 Consent Controls on the Site

We provide a cookie consent banner on your first visit, and a preference center you can re-open at any time from the "Cookie preferences" link in the Site footer. Through it you can accept all cookies, reject non-essential cookies, or choose categories individually, and change your choices later. The preference center presents four categories:

• Strictly necessary — always active; cannot be turned off.
• Functional — off by default.
• Analytics — off by default.
• Marketing (advertising/measurement) — off by default.

We currently set cookies only in the Strictly necessary and Analytics categories. The Functional and Marketing categories are offered for transparency and future use and presently place no cookies; the controls are wired so that if we later add such technologies, they will load only after you opt in. Non-essential cookies (including analytics) load only after you opt in, and we honor Global Privacy Control signals (see Section 6.3).

7. Our Consent Approach

Strictly necessary cookies are placed without consent because they are essential to operate the Site, including portal authentication and security.

For non-essential cookies (functional, analytics, and any future advertising/measurement technologies), our approach depends on what we actually deploy and on the law that applies to you:

• Today, we run only strictly necessary cookies plus analytics (a cookie-based tool that loads only after opt-in, and a cookieless tool), and we do not run advertising or behavioral-targeting trackers. Although no law currently applicable to exeral requires prior opt-in consent for analytics cookies, we have chosen to load them only after you opt in through our consent banner (see Section 6.4).
• Our cookie consent banner and preference center are live (Section 6.4). The Functional and Marketing categories are already wired into it, so as we add non-essential trackers — and as we expand into states and regions that require prior consent or an opt-out — you can accept or decline those categories before we rely on any consent-required tracker.
• Where applicable law requires opt-in consent before placing non-essential cookies, we will obtain that consent first. Where applicable law uses an opt-out model, we will provide a clear way to opt out as described in Section 6.

We are committed to describing our actual practices honestly. This Policy distinguishes between what is currently in use and what is planned, and we will update it as our practices change.

8. Third-Party Cookies, "Sale"/"Sharing," and Provider Policies

Some cookies are set by third-party service providers whose technology we use on the Site. These providers may receive certain information (such as your IP address and activity on the Site) to perform services for us. Where we have engaged a provider on service-provider or processor terms, we rely on those contractual terms to limit the provider's use of the information to providing services to us. Our specific contractual arrangements and roles (controller, processor, or service provider) with each provider are described in our Privacy Policy.

We do not sell the personal information collected by our Site cookies, and we do not "share" that information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended) and similar U.S. state privacy laws. We do not sell sensitive personal information, biometric information, or precise geolocation data collected through the Site, and we do not use Site cookies to serve interest-based advertising. This statement applies to information collected by cookies and similar technologies on the Site; our company-wide privacy practices, including any other collection or use of personal or business information, are governed by our Privacy Policy.

Because we do not sell or share the personal information collected by our Site cookies, no "Do Not Sell or Share My Personal Information" action is currently required with respect to those cookies. Should our practices change, we will post a clearly labeled opt-out mechanism and honor recognized opt-out preference signals as required by law. To exercise any privacy right or ask a question, contact us at privacy@exeral.io or see our Privacy Policy.

The third parties whose cookies or similar technologies may appear on the Site publish their own privacy and cookie policies, which we encourage you to review:

• Google (Analytics, Tag Manager): https://policies.google.com/privacy and https://policies.google.com/technologies/cookies
• Supabase: https://supabase.com/privacy
• Vercel: https://vercel.com/legal/privacy-policy

This list reflects the providers most likely to set technologies on the Site as of the date above; other providers described in our Privacy Policy generally do not place cookies on the Site. Links to third-party policies are provided for convenience; we are not responsible for the content or practices of third-party websites or services.

9. Children

The Site is intended for businesses and is not directed to children. We do not knowingly use cookies or similar technologies to collect personal information from anyone under 18. Our treatment of any data relating to minors, including obligations under the Florida Digital Bill of Rights, is described in our Privacy Policy. If you believe we have inadvertently collected such information, please contact us at privacy@exeral.io.

10. Changes to This Policy

We may update this Policy from time to time to reflect changes in technology, our practices, our service providers, or the law. When we make changes, we will revise the "Last updated" date above. Material changes may be communicated through additional notice on the Site or, where a consent banner is deployed, through that banner. Your continued use of the Site after an update takes effect means you accept the strictly necessary cookies described in the updated Policy, subject to any consent we are required to obtain for non-essential cookies.

11. Governing Law and Disputes

This Policy is incorporated into and governed by the Website Terms of Use. The Terms are governed by the laws of the State of Florida, without regard to conflict-of-laws principles, with venue and seat in Palm Beach County, Florida. The dispute-resolution provisions of the Terms — including good-faith negotiation, non-binding mediation, and binding arbitration before a single arbitrator under the AAA Commercial Arbitration Rules, together with the class-action waiver, jury-trial waiver, stated carve-outs, and prevailing-party fee provisions — and the limitation-of-liability provisions of the Terms apply to any dispute arising out of or relating to this Policy.

12. Contact Us

If you have questions about this Policy or our use of cookies, contact:

Sero LLC d/b/a exeral Attn: Privacy Boca Raton, Florida — full mailing address available on request at privacy@exeral.io Email: privacy@exeral.io Support: contact@exeral.io Phone: contact@exeral.io