Egon — Privacy Policy

Version 1.0  |  Last updated: July 20, 2026  |  Effective date: July 20, 2026

This Privacy Policy explains how Egon Labs, Inc., a Delaware corporation ("Egon," "we," "us," or "our"), the operator of the Egon platform at egon.art and related websites and applications (the "Service"), collects, uses, shares, and protects personal information. It applies to individual collectors, and to advisors and clients who use our wealth-advisory firm features. Please also read our Terms of Service. For the purposes of the EU/UK GDPR, Egon Labs, Inc. is the "controller" of the personal information described here.

1. Information We Collect

We collect the following categories of information, most of which you provide directly:

2. How We Use Your Information and Our Legal Bases

We use personal information to:

• provide the core Service — generating art-market analysis, valuations, portfolio and collection assessments, artist research, and Ask Egon responses from your data;
• personalize and improve analysis over time, including learning your preferences from your activity;
• operate advisory-firm features for linked clients and their advisors, subject to Section 6;
• authenticate you, secure the Service, prevent abuse, and provide support;
• send transactional and service messages (for example, alerts and digests you subscribe to), with an unsubscribe option for non-essential email;
• process payments if you purchase a subscription; and
• comply with law and enforce our Terms.

Where the EU/UK GDPR applies, we rely on these legal bases: performance of a contract with you (providing the Service you request, including personalized analysis); our legitimate interests (securing, analyzing, and improving the Service, learning your preferences to personalize it, and preventing abuse), balanced against your rights and subject to your right to object; consent where required (for example, linking your account to a firm, non-essential cookies/analytics, and any marketing email), which you may withdraw at any time; and compliance with legal obligations. We do not sell your personal information, and we do not use your private collection data to train models for unrelated purposes.

3. How AI Processing Works

To generate analysis, we send relevant parts of your information — such as your collection and preference context, and the artwork images you upload — to third-party AI providers that run the models Egon uses: Anthropic (Claude language models, for market and portfolio analysis) and OpenAI (GPT-5 Vision, for image analysis). These providers process the data to return results to us.

Based on these providers' commercial API terms, data submitted through their APIs is not used to train their models. We may create and use de-identified and aggregated data to improve the Service, as described in our Terms.

4. When and With Whom We Share Information

We do not sell your personal information. We share it only as described here: with the sub-processors below that help us run the Service; with a linked advisory firm as described in Section 6 and only with your consent; when you choose to share content (for example, a shared view); to comply with law or legal process; to protect the Service, our users, or others; and in connection with a business transfer such as a merger or acquisition (with notice as required by law).

Sub-processors

We rely on the following service providers, who process personal information on our behalf under data-processing agreements:

We maintain the current list of sub-processors and will update this Policy when we add or replace one.

5. Data Retention

We keep personal information for as long as your account is active and as needed to provide the Service, and thereafter as required to comply with law, resolve disputes, and enforce our agreements. Our standard periods are:

We may retain limited records longer where necessary to meet a legal obligation or resolve a dispute.

6. Advisory Firms — What Your Advisor Can and Cannot See

This Section applies only if you participate in the firm features. If you are an individual user, your data is not shared with any advisory firm, and no advisor can access it, unless you consent to link your account to that firm. You may revoke that link at any time, which stops future sharing with the firm's advisors going forward (it does not reverse disclosures already made).

When you are linked to a firm, its advisors see your data under a three-tier model that is enforced in our software:

7. Your Rights and Choices

You can exercise the following controls, most of them directly in the Service:

• Access and portability. You can request and download an export of your data in a machine-readable format.
• Correction. You can edit your profile, preferences, and collection data at any time.
• Deletion. You can delete your account, which triggers deletion of your personal data across our systems, subject to the exceptions in Section 5.
• Advisor link. You can grant or revoke a firm link at any time (Section 6).
• Email choices. You can unsubscribe from non-essential emails.

EEA/UK residents. You have the rights to access, rectify, erase, and restrict processing of your personal data; to data portability; to object to processing based on legitimate interests; and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). We will respond within the timeframes required by law (generally within one month).

We will not discriminate against you for exercising your rights. To make a request, contact privacy@egon.art; we may need to verify your identity before acting on a request.

8. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, this Section supplements the rest of this Policy. In the past 12 months we have collected the categories of personal information described in Section 1 (identifiers, customer records, commercial information, internet/usage activity, and inferences), for the business purposes described in Section 2, and have disclosed them to the service providers described in Section 4 for those purposes.

We do not "sell" your personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not knowingly sell or share the personal information of anyone under 16.

You have the right to:

• know and access the personal information we have collected about you;
• request deletion of your personal information;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of personal information (we do neither); and
• limit the use of sensitive personal information (we use it only to provide the Service and for other permitted purposes).

You will not be discriminated against for exercising these rights, and you may use an authorized agent. To submit a request, email privacy@egon.art; we will verify your request and respond as required by law, and you may appeal a decision by replying to our response.

9. International Data Transfers

We host and process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other countries where we or our sub-processors operate, which may have data-protection laws different from those in your country.

Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss addendum where applicable — along with supplementary measures as needed. You may contact us for more information about these safeguards.

10. Cookies and Analytics

We use cookies and similar technologies that are strictly necessary to operate the Service — primarily for authentication and session management — which do not require consent. We also use a product-analytics provider (PostHog) to understand how the Service is used so we can improve it. Where required by law (for example, in the EEA and UK), we use non-essential cookies and analytics only with your consent, which we request through a cookie banner, and you can change your choices at any time. You can also control cookies through your browser settings.

11. How We Protect Information

We use technical and organizational measures designed to protect personal information, including encryption in transit and at rest, hashed passwords, access controls, and filtering that keeps prompts, credentials, and request contents out of our error monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a data breach affecting your personal information, we will notify affected users and the relevant authorities as required by applicable law — including, where the GDPR applies, notifying the competent supervisory authority within 72 hours of becoming aware where feasible, and notifying affected individuals without undue delay where the breach is likely to result in a high risk to their rights.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice — for example, by email or a prominent in-product notice — and update the "Effective date" above. Where required by law or where the change is material (such as the advisor-visibility model in Section 6), we will seek your consent before the change applies to you.

13. Contact Us

Questions or requests regarding this Policy or your data can be sent to privacy@egon.art. If you need our postal address for a formal request or notice, contact us and we will provide it.