STOOK — PRIVACY POLICY Last Updated: July 6, 2026 Beta Disclaimer: Please note that Stook is currently in its beta testing phase. Our platform is continually evolving. This Privacy Policy reflects our commitment to safeguarding your data during this testing period; however, you are fully aware of the initial steps and take full responsibility for any information you submit to us. As we refine and enhance the platform and its services, we may update this Policy accordingly. We encourage you to review this Privacy Policy regularly for any changes. The Stook platform (the "Platform") is provided and operated by Streetwise N.Z. Ltd. ("we," "our," or "us"), available at stookapp.com. Preamble This Privacy Policy (the "Policy") describes our data collection and processing practices and gives you information about how we treat your personal data when you access and use the Stook platform, available at stookapp.com. This Policy forms part of your agreement with us when you install, access, and/or use the Platform or otherwise engage with any related features, forms, or services we make available through the Platform (the "Services"). Please read this Policy carefully before using the Platform and Services. If you do not agree with any of the terms provided in this Policy, please do not access or use the Platform or Services. If you have any questions, please contact us at hello@stookapp.com. Please note that this Policy is designed with the EU General Data Protection Regulation (GDPR) in mind. If you are a resident of any jurisdiction other than the EU/EEA or UK and wish to exercise any privacy rights not indicated in this Policy, please reach out to us at hello@stookapp.com. 1. Data Controller Controller Information: Streetwise N.Z. Ltd. is the data controller of your personal data processed in connection with the Platform and Services. The company is a private limited company based in Israel, located at [Registered Address, Israel]. Data Protection Contact: If you wish to contact us in any matter concerning this Policy and your privacy rights, please email us at hello@stookapp.com. 2. Data Subjects We use data collected through the Platform and Services depending on whether you are: "User" — an individual who registers for and uses the Platform directly; or "Organization Account" — a business, team, or company that subscribes to Stook for team use, whose members are individual Users. Both are referred to in this Policy as "you." 3. Consent and Choice You are not legally obligated to provide us with Personal Information, and you acknowledge that providing us with Personal Information is done freely. You also acknowledge that some features and Services can only be made available upon the processing of certain Personal Information. In such a case, you can choose whether you want to use such additional features or not. To learn about your rights to your Personal Information, including how to withdraw consent, refer to Section 10 below. 4. Information We Process, Purpose, Lawful Basis, and Retention Personal Information (PI): information that identifies you as a natural person, or that may be used, alone or in combination with other information, to personally identify you. This includes first and last name, email address, phone number, physical address, and other contact information. In some jurisdictions, an IP address, device ID, and cookies may also be considered Personal Information. Non-Personal Information (non-PI): information that cannot personally identify a natural person, such as statistics, aggregated data, or anonymized information. 4.1 Information You Submit to Us Contact details. We may process your contact details (such as email address or phone number) when you open an account, subscribe to our mailing list, or reach out to our support services. Purpose Lawful Basis Retention To address your requests, inquiries, or communications regarding the Platform and Services. Your consent and our legitimate interest. For as long as needed to resolve the matter, or as required by applicable law. Subscription to our mailing list. If you voluntarily subscribe to our email communications, you will be asked to provide your email address. You can unsubscribe at any time via the unsubscribe option in any email we send, or by contacting us at hello@stookapp.com. Purpose Lawful Basis Retention To send you information related to the Platform, Services, new features, and product updates. Your consent (by actively submitting your email address). For as long as you have not explicitly asked us to delete it, or until we learn it was unlawfully collected, provided no legal exemption applies. Account registration and management. Users are required to sign up and register for an account. When signing up, we process: user credentials (email address and password), processed by a trusted third-party authentication service; and optional profile information you choose to associate with your account. Purpose Lawful Basis Retention To uniquely connect your account and activity to your user profile, assign an account to you, and authenticate and authorize your access. Your consent and our legitimate interest to secure access to user accounts. For as long as your account is active, or until you explicitly request deletion, provided the information is not required to provide you with the Services or as required by applicable law. If billing is involved, we may retain billing data for up to seven (7) years from the billing event, as required by applicable tax laws. User profile, activity, and user-generated content (UGC). You may submit optional profile information (editable or deletable at any time), including profile image, nickname, name, email, phone number, and work information. You may also create and submit cue cards, scripts, speech notes, and other practice materials as user-generated content. This information is submitted entirely upon your choice. We do not read, sell, or monetize your practice materials. Purpose Lawful Basis Retention To facilitate and store your user-generated content and practice materials within the Platform. You can modify, export, or delete this information at any point. Your consent. For as long as your account is active or until you explicitly request deletion. Support. When you contact us, we may process your inquiry details and contact information to address your request. This includes information submitted via email, online form, bug report, or survey. Purpose Lawful Basis Retention To respond to your inquiry and provide you with the support or information you have requested. Your consent and our legitimate interest to address your inquiry and maintain a record for monitoring or compliance purposes. For as long as needed to provide you with the requested service, or as required by applicable law. Mobile permissions. When you use the Platform via a mobile application, you may be asked to approve certain permissions (such as push notifications, camera access, or media files). Some permissions are opt-in and some are opt-out. The operating system of your mobile device will request these permissions accordingly. 4.2 Information Collected Automatically Online Identifiers. When you use the Platform online, we may process the IP address assigned to your device, cookie information, and user agent (browser and IP address information). This is collected through cookies, pixel tags, and log files, and includes online usage data and login data. Purpose Lawful Basis Retention (i) Analytics — to understand how Users interact with the Platform. (ii) Fraud detection and prevention — to monitor and detect automated or unauthorized actions. (iii) Localization — to serve the Platform in the appropriate language and in compliance with your jurisdiction. Your consent (obtained through our cookie consent notification). Necessary cookies are used as part of our legitimate interest in Platform functionality. Cookie retention periods vary by type. Please refer to our Cookie Policy. Otherwise, we retain online information for as long as necessary to achieve the stated purposes, or until it is converted to Non-Personal Information. Device Information. We may collect information about the device from which you access the Platform, such as browser type and version, IP address, operating system, device type (mobile/desktop), and language settings. Purpose Lawful Basis Retention Compatibility purposes and to offer features specifically designed for your device type. Your consent, and in certain cases, our legitimate interest. For as long as necessary to provide Platform functionality and maintain a record of your access and usage. Activity log and analytics. We automatically record and process activities related to your usage of the Platform and Services in order to be responsive to them or allow you to revert certain actions. 4.3 Information We May Receive from Third Parties Personal Data provided to us by third parties, including service providers who process your data on our behalf, or when you choose to link social media profiles through which we may access your public profile information. 5. Lawful Basis for Processing Personal Information Our lawful basis to process your Personal Information depends on the specific context: Where you have given us your consent (e.g., when you open an account, subscribe to emails, or confirm cookie usage); Where processing is in our legitimate interests and not overridden by your data protection interests (e.g., to provide core Services, for anti-fraud purposes, or to improve the Platform); Where processing is necessary to perform a contract with you (e.g., if you purchase a paid subscription); or Where we have a legal obligation to collect or retain Personal Information. If you have questions about the legal basis on which we collect and use your Personal Data, please contact us at hello@stookapp.com. 6. Cookies and Web Technologies A cookie is a small text file placed on the browser or hard drive of your computer (or similar device) by websites you visit. Cookies make the Platform easier to use and improve its functionality. They are used to facilitate the login process, track usage and preferences, and improve the overall user experience. Some third-party tools integrated into the Platform may use their own cookies. Please refer to our Cookie Policy for more information. You may set your browser to refuse or block any cookies from us or our third-party partners; however, some features may not function properly as a result. 7. How We Use Your Information We use Personal Information for the purposes described next to each data category above, and for the following general purposes: Providing, supporting, improving, and securing the Platform and Services; Preventing fraud and monitoring unlawful activity or user-generated content; Opening an account for you, managing it, and supporting it; and Communicating with you about the Platform, new features, and updates. 8. Sharing Personal Information In order to develop, operate, and provide the Platform and Services, we may share or disclose information to third parties as follows: Service Providers (Processors). Our processors include tools, software, technologies, services, vendors, and contractors who perform certain functions on our behalf. This includes developers, hosting and storage providers, security and authentication services, analytics, and support services. For more information about third-party services, please refer to Section 9 below. Legal Proceedings or Legal Requirements. We may share your Personal Information with any third party if we believe that disclosure is helpful or reasonably necessary to: (a) comply with any applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service or this Privacy Policy, including investigations of potential violations thereof; (c) detect, prevent, or address fraud or security issues; and/or (d) protect against harm to the rights, property, or safety of our users, personnel, or the public. Merger, Sale, or Restructuring. In the event that we are acquired by or merged with a third-party entity, or sell all or part of our assets, we may transfer or assign the Personal Information we have collected. In such a case, we will require the acquiring entity to maintain the same data practices and provide you with any applicable rights. 9. Third-Party Services In order to provide, operate, maintain, and improve the Platform and Services, we use the following categories of third-party services, which may hold their data centers outside the EU or EEA: Hosting and storage. We use Supabase (supabase.com) for database hosting and storage, and Vercel (vercel.com) for application hosting and delivery. These providers may be based and their servers may be located anywhere in the world. We require each such provider to maintain strict privacy protection and data security policies. Frontend platform. The Platform is built and operated with the assistance of Lovable (lovable.dev), a frontend development platform. Authentication and security. We use Supabase Auth for account authentication and authorization. Analytics. We may use analytics services to understand how Users interact with the Platform and Services, and to improve its features and performance. Support services. We may use support and help desk services to provide faster and better support to users. CRM and mailing lists. We may use services to manage and secure your Personal Information and to manage subscription and notification lists. 10. Your Rights and Choices Depending on your country of residence, certain rights concerning your Personal Information may be available to you. Please contact us at hello@stookapp.com with your detailed request and sufficient information to allow us to verify your identity, and we will process your request within the timeframe indicated in the applicable regulation. If you have an account with us, many of these rights are directly accessible from your account settings. Right of access: You may ask us to access any Personal Data held about you. Right to rectification: You have the right to ask us to correct any inaccurate information we hold about you. Right to erasure: You may ask us to delete your information or to stop processing it, where allowed by applicable law. Right to restriction of processing: You may ask us to temporarily cease the processing of your Personal Information, or for a specific purpose or function. Right to object to processing: You may request us to stop processing your Personal Information, subject to applicable exceptions. Right to data portability: You may request an export of your Personal Data in a reusable format, or to have such data transferred directly to another vendor offering related services. Right to withdraw consent: Where you have given us your consent to use your information for a specific purpose, you may withdraw your consent at any time, and we will stop using your information for that purpose. Right to lodge a complaint: If you live in a country where the GDPR applies (e.g., the EU, EEA, or UK), you may lodge a complaint with the relevant data protection authority if you believe your rights have not been respected. 11. Exercising Your Rights You can exercise your rights by reaching out to us at hello@stookapp.com. If you have an account with us, many rights are also accessible directly from your user profile and account settings. 12. Information Security We implement organizational and technical measures to protect against unauthorized access to Personal Information, including by using third-party services specializing in data security and by designing the Platform with privacy-protective choices. We periodically review our information and data collection practices to ensure constant monitoring, use third-party processing services that implement various information security standards, and monitor and filter access to data by personnel. Such systems and procedures reduce the risk of security breaches, but cannot provide absolute security. We cannot guarantee that the Platform and our servers are immune to unauthorized access. If you have any questions about the security of the Platform or Services, you can contact us at hello@stookapp.com. 13. Transfers of Personal Information We may transfer your information (including Personal Information) outside the country in which it is collected or in which you reside, including to countries that may not offer the same level of protection for Personal Information as your country of residence. In such cases, we make sure to place all contractual safeguards, including verification of adequate protection measures and security certificates. By providing Personal Information and using the Services, you expressly consent to the transfer of your information to another country (including Israel, the UK, or the US), in accordance with this Privacy Policy. 14. Data Retention Except as explicitly provided otherwise in this Policy, we will retain your information for as long as your account is active or as needed to provide the Services to you, in accordance with applicable laws. We may at our sole discretion delete or amend information from our systems once we deem it is no longer necessary for such purposes. Any communication data, including Personal Information, is stored for as long as needed to provide you with the requested service or as required by law. 15. Children The Platform is not designed for use by individuals under the age of 18. Please do not allow any underage access to the Platform or Services. 16. Changes to This Policy We may, from time to time, modify, add, or delete provisions of this Policy to conform to a new regulation, requirement, or if we introduce a new product, feature, or Personal Information processing activity. In cases of a material change, we will provide you with a more prominent notice, for example, by sending you an email notification. If the change is not material, we will post the updated Policy on our Site and Services, and the changes will be reflected in the "Last Updated" date. Your continued use of the Platform or Services following the effective date of any such modification means you accept and agree to be bound by the updated Privacy Policy. 17. Special Jurisdictions Upon expansion of the Platform and Services to additional jurisdictions, we may introduce supplemental notices to address jurisdiction-specific requirements. 18. Questions If you have any inquiries regarding this Policy, please do not hesitate to contact us at hello@stookapp.com.