CoExcel Solutions | SourceBoard® Effective Date: April 2, 2026 | Last Updated: April 2, 2026

CoExcel Solutions LLC, together with its affiliated platform SourceBoard® (collectively, "CoExcel," "we," "us," or "our"), is committed to protecting the privacy, confidentiality, and security of your personal information. This Privacy Policy ("Policy") describes how we collect, use, process, store, share, and protect information obtained through our website, the SourceBoard® platform, AI-powered tools and features, content publications, email communications, marketing activities, and all related services (collectively, the "Services").

This Policy applies to all visitors, registered users, clients, prospective clients, newsletter subscribers, event attendees, and any other individuals who interact with our Services. By accessing or using our Services, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

This Policy is incorporated by reference into our Terms and Conditions of Use.

2.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you:

• Register for an account or access platform features;
• Submit a contact form, request a consultation, or engage our advisory services;
• Subscribe to our newsletter, blog, or content publications;
• Participate in surveys, questionnaires, or market research;
• Attend webinars, events, or demonstrations;
• Submit inputs to AI Tools, capability builders, or compliance analysis features;
• Apply for employment or contractor positions;
• Communicate with us by email, phone, or other channels.

This information may include: full name; business name and title; email address; mailing address; phone number; job function and industry role; organizational size and contract vehicle information; and any other information you choose to provide.

2.2 Information Collected Automatically

When you access the Services, we and our service providers automatically collect certain technical and usage information, including:

• IP address and approximate geographic location;
• Browser type, version, and operating system;
• Device type and unique device identifiers;
• Referring URLs and exit pages;
• Pages viewed, features accessed, and time spent on pages;
• Search queries and navigation patterns within the Services;
• Date and time of access;
• Clickstream data and interaction logs.

2.3 Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, local storage, and similar tracking technologies to collect information about your interactions with the Services. See Section 5 (Cookies and Tracking Technologies) for a full description of our cookie practices.

2.4 AI Tool Inputs and Outputs

When you use AI Tools — including SourceBoard® procurement features, capability statement builders, FAR/DFARS compliance analyzers, supplier intelligence tools, or any other AI-powered feature — we may collect the content of your inputs, query parameters, uploaded documents, and the outputs generated. This data is used to provide the requested functionality, improve our systems, and maintain audit logs.

2.5 Information from Third Parties

We may receive information about you from third-party sources, including:

• Business contact database and data enrichment providers;
• Government contractor databases and public procurement registries (e.g., SAM.gov);
• Marketing and analytics platforms;
• CRM integrations and partner referrals;
• Social media platforms if you connect or interact with us through such channels.

2.6 Communications Data

We retain records of email, chat, and other communications you have with us, including support tickets, consultation records, and marketing responses.

3.1 Providing and Operating the Services

• Creating and managing your account;
• Delivering advisory, consulting, and platform services you have requested;
• Processing and responding to inquiries and consultation requests;
• Operating SourceBoard® procurement and sourcing workflows;
• Powering AI Tool functionality and generating requested outputs.

3.2 Business Communications

• Sending transactional communications, including account confirmations and service updates;
• Distributing newsletters, industry intelligence briefings, supplier spotlights, and editorial content;
• Notifying you of webinars, events, product launches, and new features;
• Responding to your questions and support requests.

3.3 Marketing and Business Development

• Sending promotional communications about CoExcel Solutions services and SourceBoard® features, subject to your communication preferences;
• Conducting account-based marketing (ABM) campaigns targeting defense industrial base companies and government contractors;
• Personalizing marketing content based on your industry role, organizational profile, and past interactions;
• Retargeting advertising through third-party platforms (see Section 5);
• Measuring the effectiveness of marketing campaigns.

3.4 Analytics and Service Improvement

• Analyzing usage patterns to improve the Services;
• Training and improving AI models using anonymized and aggregated data;
• Conducting A/B testing and user experience research;
• Generating internal business intelligence and reporting.

3.5 Legal and Compliance

• Complying with applicable law, regulation, and legal process;
• Enforcing our Terms and Conditions and other agreements;
• Preventing fraud, abuse, security threats, and unauthorized access;
• Protecting the rights, property, and safety of CoExcel, our users, and the public.

For users in jurisdictions requiring a legal basis for data processing (including the European Economic Area, United Kingdom, and California), we process personal data on the following bases:

• Contract Performance: Processing necessary to provide services you have requested or contracted for;
• Legitimate Interests: Processing for our legitimate business interests in operating, improving, and marketing the Services, where these are not overridden by your rights;
• Consent: Processing based on your opt-in consent, including for marketing communications and non-essential cookies;
• Legal Obligation: Processing required by applicable law or regulation.

5.1 Types of Cookies We Use

Strictly Necessary Cookies: Essential for the Services to function. These cannot be disabled. Examples include session management, security tokens, and load balancing.

Performance and Analytics Cookies: Help us understand how visitors interact with the Services. We use tools such as Google Analytics to collect aggregated traffic and behavior data.

Functional Cookies: Remember your preferences and settings, such as language, display options, and previously entered data.

Marketing and Targeting Cookies: Used to deliver relevant advertising and content, measure campaign effectiveness, and support retargeting. These cookies may be set by us or by third-party advertising partners including LinkedIn, Google Ads, Meta (Facebook), and others.

Third-Party Cookies: Set by third-party services embedded in the Services, such as video players, social sharing buttons, and integrated marketing tools. These are governed by the privacy policies of the respective third parties.

5.2 Cookie Duration

Cookies may be session-based (deleted when you close your browser) or persistent (remaining on your device for a defined period). Persistent cookies typically expire between 30 days and 24 months depending on their purpose.

5.3 Your Cookie Choices

You may control cookie settings through:

• Our cookie consent banner displayed upon first visit to the Services;
• Your browser settings, which allow you to block or delete cookies (note: disabling essential cookies may impair functionality);
• Opt-out tools provided by third-party analytics and advertising providers (e.g., Google Analytics Opt-out Browser Add-on, LinkedIn Ads Settings, Meta Ad Preferences);
• The Network Advertising Initiative (NAI) opt-out tool or Digital Advertising Alliance (DAA) opt-out page.

Please note that opting out of marketing cookies does not mean you will not see advertising; it means that advertising will not be personalized based on your tracked behavior.

5.4 Do Not Track

Our Services do not currently respond to "Do Not Track" browser signals. If this changes, we will update this Policy accordingly.

5.5 Web Beacons and Pixel Tags

Our email communications and web pages may contain small electronic files (web beacons or pixel tags) that allow us to track email open rates, click-through rates, IP addresses, and other engagement metrics. You may disable this by setting your email client to not display images.

CoExcel does not sell your personal information. We may share information as follows:

6.1 Service Providers

We engage trusted third-party vendors and service providers who process data on our behalf for purposes such as: cloud hosting and infrastructure; CRM and marketing automation (e.g., HubSpot); email delivery; analytics; payment processing; AI model APIs; document management; and cybersecurity. These providers are contractually required to protect your data and may only use it to perform services for us.

6.2 Business Partners and Referrals

With your consent, we may share your information with strategic partners, teaming partners, or referral sources in connection with business opportunities relevant to your engagement with CoExcel or SourceBoard®.

6.3 Professional Advisors

We may share information with attorneys, accountants, insurers, and other professional advisors as necessary to conduct our business and protect our legal rights.

6.4 Legal and Regulatory Requirements

We may disclose your information to government authorities, law enforcement, courts, or regulators when required by applicable law, subpoena, court order, or legal process, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6.5 Business Transfers

If CoExcel undergoes a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and any changes to privacy practices.

6.6 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to provide Services, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type:

• Account data: Retained for the duration of your account plus up to 7 years after closure for legal compliance;
• Marketing and communication data: Retained until you unsubscribe or request deletion, subject to applicable law;
• AI Tool inputs and outputs: Retained for up to 3 years for service improvement and audit purposes, or as required by contract;
• Financial and transaction records: Retained for a minimum of 7 years in accordance with tax and accounting laws;
• Website analytics data: Retained in anonymized or aggregated form for up to 26 months.

When data is no longer required, we securely delete or anonymize it.

CoExcel implements reasonable and appropriate technical, administrative, and physical safeguards to protect your information from unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption of data in transit using TLS;
• Access controls and role-based permissions;
• Secure cloud infrastructure with industry-standard certifications;
• Regular security assessments and vulnerability monitoring;
• Employee security training and confidentiality obligations.

No system is completely secure. While we take data security seriously, we cannot guarantee absolute security of your information. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

9.1 General Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you;
• Correction: Request that we correct inaccurate or incomplete information;
• Deletion: Request that we delete your personal information, subject to legal retention obligations;
• Objection: Object to processing based on legitimate interests or for direct marketing;
• Restriction: Request that we restrict processing of your information in certain circumstances;
• Portability: Receive your information in a structured, machine-readable format;
• Withdrawal of Consent: Withdraw previously given consent without affecting the lawfulness of prior processing.

9.2 California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what personal information is collected, used, shared, or sold;
• The right to delete personal information (subject to exceptions);
• The right to correct inaccurate personal information;
• The right to opt-out of the sale or sharing of personal information (CoExcel does not sell personal information);
• The right to limit the use and disclosure of sensitive personal information;
• The right to non-discrimination for exercising your privacy rights.

To submit a California privacy request, contact us at contact@CoExcel-Solutions.com  We will verify your identity before processing requests. Authorized agents may submit requests on your behalf with proper documentation.

9.3 How to Exercise Your Rights

To exercise any privacy right, please contact us at contact@CoExcel-Solutions.com  We will respond within 30 days (or as otherwise required by applicable law). We may ask you to verify your identity before fulfilling your request.

10.1 Opt-In and Consent

We send marketing emails, newsletters, industry briefings, and promotional communications to individuals who have opted in to receive them. Opt-in may occur through website forms, event registrations, consultation requests, or other voluntary interactions with the Services.

10.2 Opt-Out and Unsubscribe

You may unsubscribe from marketing communications at any time by clicking the "Unsubscribe" link in any marketing email, or by contacting us at contact@CoExcel-Solutions.com. Please allow up to 10 business days for opt-out requests to be processed. Transactional and service communications related to your account or contracted services will continue regardless of marketing preferences.

10.3 Email Tracking

Our marketing emails may use tracking technologies to measure open rates, click-through rates, and engagement. This data helps us improve our content and understand subscriber interests. You may disable email tracking by blocking image loading in your email client.

10.4 CAN-SPAM Compliance

All commercial email communications from CoExcel comply with the CAN-SPAM Act, including accurate sender identification, non-deceptive subject lines, and a functional unsubscribe mechanism in every commercial email.

11.1 Inputs to AI Tools

You are responsible for ensuring that any data you input into CoExcel AI Tools is appropriate for processing through a cloud-based service. Do not input classified information, controlled unclassified information (CUI), sensitive personally identifiable information (PII/SPII), or export-controlled data unless you have verified the authorization of our systems to handle such data. CoExcel is not responsible for any regulatory violation arising from your unauthorized submission of sensitive data to AI Tools.

11.2 Use of AI Interaction Data

Interaction data from AI Tools may be used in anonymized and aggregated form to improve model accuracy and platform performance. CoExcel does not use individually identifiable AI Tool inputs to train third-party AI models or share such data with third-party AI providers without contractual data protection agreements.

11.3 Third-Party AI APIs

Some AI features may be powered by third-party large language model APIs. These third-party providers are governed by their own privacy policies and data processing agreements. CoExcel selects AI API partners with robust data protection commitments.

The Services are not directed to, and we do not knowingly collect personal information from, individuals under the age of 18. If we become aware that we have inadvertently collected information from a minor, we will promptly delete it. If you believe a minor has provided us with personal information, please contact us at contact@CoExcel-Solutions.com

The Services may contain links to external websites, partner platforms, or integrated third-party services. CoExcel is not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any third party before providing your personal information.

CoExcel's Services are operated in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Services, you consent to such transfer. Where required by applicable law, we implement appropriate safeguards for international transfers, including standard contractual clauses.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the updated Policy on our website with a revised "Last Updated" date. For material changes, we will provide additional notice (such as an email notification or a prominent banner on the website). Your continued use of the Services following any update constitutes your acceptance of the revised Policy.

CoExcel Solutions LLC is the data controller for personal information collected through the Services. For questions, requests, or concerns related to this Privacy Policy or our data practices, please contact:

Privacy Officer — CoExcel Solutions LLCBinghamton, New York Email: contact@coexcel-solutions.com General Inquiries: contact@coexcel-solutions.com Website: www.coexcel-solutions.com

We aim to respond to all privacy inquiries within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with the applicable supervisory or regulatory authority in your jurisdiction.

CoExcel Solutions | SourceBoard®