Customer Data & Security Policy

This Nuveda AI Customer Data & Security Policy (“Security Policy”) establishes the privacy, confidentiality, security, access-control, device, account, data-handling, incident-reporting, and offboarding requirements applicable to Nuveda AI Business Advisors.

This Security Policy forms part of and is incorporated into the Nuveda AI Business Advisor Agreement (“Business Advisor Agreement”).

No separate signature or separate electronic acceptance of this Policy is required. An Advisor accepts this Policy by electronically accepting the Business Advisor Agreement.

1. Purpose

The purpose of this Policy is to protect:

Nuveda AI customer information;
prospective-customer information;
personal information;
confidential business information;
Nuveda AI systems;
Nuveda AI accounts;
Advisor credentials;
Company communications;
customer relationships;
intellectual property;
security information; and
other data accessed through the Business Advisor Program.

Advisors may access information only to the extent necessary and authorized for legitimate Business Advisor activities.

2. General Security Duty

Business Advisors must take reasonable steps to protect information and systems made available through the Business Advisor Program.

Advisors must:

use information only for authorized purposes;
protect credentials;
restrict access to authorized persons;
avoid unnecessary collection or retention;
use approved systems where required;
promptly report suspected security incidents;
comply with applicable privacy and security requirements; and
follow reasonable Nuveda AI security instructions.

3. Principle of Minimum Necessary Access

Advisors should access only the information reasonably necessary to perform authorized Business Advisor activities.

Access to the Business Advisor Program does not create unrestricted access to:

all Nuveda AI customers;
all leads;
all CRM records;
all Company communications;
other Advisors’ accounts;
technical infrastructure;
security controls;
administrative systems; or
confidential Company data.

Nuveda AI may limit access according to role, customer assignment, business need, and security requirements.

4. Customer Information

“Customer Information” may include information relating to current or prospective Nuveda AI customers, including:

names;
business contact information;
company information;
account information;
customer communications;
sales notes;
discovery information;
purchasing information;
contract-related information;
customer requirements;
technical requirements;
business-use cases;
customer preferences;
account status;
sales history; and
other non-public customer information.

Customer Information must be treated as confidential unless Nuveda AI expressly states otherwise.

5. Personal Information

Personal Information may include information that identifies or can reasonably be linked to an individual.

Advisors should collect and use Personal Information only where reasonably necessary for authorized Business Advisor activities.

Advisors should avoid collecting unnecessary sensitive information.

6. Prohibited Collection

Unless specifically authorized and genuinely necessary, Advisors should not request or collect:

Social Security numbers;
banking passwords;
full payment-card details;
medical records;
government account passwords;
unnecessary copies of identity documents;
passwords to customer systems;
unrelated biometric information;
highly sensitive personal information unrelated to the sales process; or
other information that Nuveda AI does not reasonably need.

7. Identity Verification

Where identity verification is required for an Advisor, the Advisor must use the authorized verification process provided by Nuveda AI.

Nuveda AI currently uses Didit for certain identity-verification activities.

Advisors should not independently collect copies of another Advisor’s identity documents for Program purposes unless expressly authorized.

8. Customer Payment Information

Business Advisors should not independently collect or store complete customer payment-card information unless Nuveda AI has expressly authorized a specific process.

Customers should make payments through approved Nuveda AI payment systems.

Advisors may not request that customers send:

complete card numbers;
card security codes;
banking passwords;
payment credentials; or
other restricted financial credentials

through email, text message, direct message, or other unauthorized channels.

9. Customer Passwords

Advisors should not request or retain customer passwords unless Nuveda AI has expressly authorized a specific technical process requiring them.

Where a customer needs to connect an external service, the customer should generally authenticate directly through the approved platform or authorization process rather than sharing credentials with an Advisor.

10. Account Credentials

Advisor credentials are personal to the authorized Advisor.

Advisors may not share:

Advisor Center passwords;
CRM passwords;
Nuveda AI email passwords;
authentication codes;
recovery codes;
access tokens;
API keys;
administrative credentials; or
other restricted credentials.

11. Multi-Factor Authentication

Where Nuveda AI requires multi-factor authentication (“MFA”), Advisors must maintain MFA on the applicable account.

Advisors may not intentionally disable or bypass required MFA.

Advisors must protect MFA devices, codes, recovery credentials, and authentication applications.

12. Password Security

Advisors must use reasonably secure passwords or passphrases for Program systems.

Advisors should not:

reuse compromised passwords;
share passwords;
store passwords in plainly visible locations;
send passwords through insecure communications; or
deliberately weaken required account protections.

Use of an approved password manager is encouraged where appropriate.

Account sharing is prohibited unless Nuveda AI expressly authorizes a specific shared-account arrangement.

An Advisor may not allow:

assistants;
family members;
employees;
contractors;
other Advisors; or
third parties

to use the Advisor’s credentials.

If another person requires access, that person must receive separate authorization where appropriate.

14. Nuveda AI Email Accounts and Aliases

Nuveda AI may provide Advisors with Company-managed email accounts, aliases, or other communication tools.

Such accounts:

remain under Nuveda AI control;
may be subject to security requirements;
may be subject to retention;
may be disabled at any time when authorization ends;
may be reviewed or administered as permitted by law;
may not be transferred to the Advisor; and
are intended primarily for authorized Nuveda AI business communications.

15. No Expectation of Ownership in Company Accounts

An Advisor does not own:

Nuveda AI email accounts;
aliases;
CRM accounts;
Advisor Center accounts;
customer records;
Company contacts;
internal messages;
sales records; or
other Company-provided accounts or data.

Access is a limited privilege granted for authorized Program purposes.

16. Personal Devices

Nuveda AI may permit Advisors to use personal computers or mobile devices for authorized Program activities.

Where personal devices are used, Advisors must take reasonable security precautions, including as appropriate:

device passwords or biometric locks;
operating-system updates;
supported software;
antivirus or endpoint protection where appropriate;
automatic screen lock;
secure storage;
encryption where supported;
and reasonable protection against unauthorized physical access.

17. Lost or Stolen Devices

An Advisor must promptly report a lost or stolen device where the device contains or can access:

customer information;
Nuveda AI email;
CRM records;
Advisor Center;
Company documents;
confidential information; or
other Program systems.

Nuveda AI may require:

password resets;
session revocation;
device removal;
token revocation;
or other protective measures.

18. Shared Computers

Advisors should avoid accessing sensitive Program systems through publicly accessible or untrusted shared computers.

If shared equipment must be used, the Advisor must take appropriate precautions and ensure credentials and information are not retained on the device.

19. Public Wi-Fi

Advisors should exercise caution when accessing sensitive Company or customer information over unsecured public networks.

Where Nuveda AI requires a VPN or another security control, the Advisor must use it.

20. Software Updates

Advisors should keep devices and software used for Program activities reasonably current with security updates.

Advisors may not knowingly use materially insecure or unsupported systems where doing so creates a significant risk to Nuveda AI or customer information.

21. Malware and Malicious Software

Advisors may not intentionally introduce or distribute:

malware;
ransomware;
viruses;
spyware;
credential stealers;
malicious browser extensions;
malicious scripts; or
other harmful code

through Nuveda AI systems or customer communications.

22. Phishing

Advisors must exercise reasonable caution regarding suspicious:

emails;
login pages;
attachments;
links;
authentication requests;
payment requests; or
identity-verification messages.

Suspected phishing involving Nuveda AI credentials or customers should be reported promptly.

23. Email Attachments and Links

Advisors should avoid opening suspicious attachments or links and should not send customer information through insecure channels where a more appropriate authorized system is available.

24. Customer Data Storage

Customer Information should be stored in approved Nuveda AI systems where available.

Advisors should avoid unnecessary local copies.

Advisors may not create independent databases of Nuveda AI customer information for unrelated purposes.

25. Local Downloads

Advisors should not download customer lists, CRM exports, prospect databases, or large quantities of customer information unless the download is:

authorized;
reasonably necessary;
securely stored; and
used solely for legitimate Nuveda AI business purposes.

Nuveda AI may restrict or disable export functionality.

26. Bulk Exports

Bulk exports of customer or prospect information may require specific authorization.

Unauthorized scraping, bulk extraction, or mass downloading may result in immediate suspension.

27. Printing

Advisors should avoid printing Customer Information unless reasonably necessary.

Printed materials containing confidential or personal information must be secured and appropriately destroyed when no longer needed.

28. Screenshots

Advisors may not take screenshots containing Customer Information, confidential Company information, or restricted system information unless reasonably necessary and authorized.

Screenshots must not be shared outside authorized channels.

29. Cloud Storage

Advisors may not upload Nuveda AI or customer information to unauthorized personal cloud-storage services.

Examples may include personal storage accounts that Nuveda AI has not approved for Company data.

30. Third-Party Applications

Advisors may not connect unauthorized third-party applications to:

Nuveda AI email;
CRM;
Advisor Center;
customer databases;
APIs;
internal systems; or
other Program accounts.

Third-party integrations may create access to Company or customer information and therefore require authorization where appropriate.

31. Artificial Intelligence Tools

Advisors may use AI tools for authorized activities only in a manner consistent with Nuveda AI instructions and this Policy.

Advisors must not enter Customer Information, confidential information, internal documents, security information, or other restricted data into an external AI service unless Nuveda AI has authorized that use.

32. Public AI Services

Unless specifically authorized, Advisors should not submit confidential or customer-specific information into publicly available AI systems, consumer AI accounts, or other external tools that have not been approved for handling the information.

This includes information copied from:

CRM;
customer discovery records;
contracts;
customer communications;
internal documents;
security materials; or
account records.

33. AI-Generated Output

AI-generated output used in customer-facing communications must be reviewed for:

accuracy;
confidentiality;
fabricated information;
unauthorized claims;
customer information;
misleading content; and
security or compliance representations.

AI output does not relieve the Advisor of responsibility.

34. Customer Recordings

Advisors may not record customer meetings or calls without appropriate authorization and compliance with applicable law.

Where recording is authorized, the recording must be handled as confidential information.

Where customer consent is legally or contractually required for a data-processing activity, the Advisor must follow the applicable approved process.

Advisors may not fabricate consent.

36. Data Minimization

Advisors should collect the minimum amount of customer information reasonably necessary to:

qualify a prospect;
conduct discovery;
facilitate a sale;
coordinate technical assistance;
support onboarding; or
perform another authorized activity.

37. Purpose Limitation

Customer Information obtained through Nuveda AI may be used only for legitimate authorized purposes.

It may not be repurposed for:

unrelated personal businesses;
independent mailing lists;
unrelated marketing campaigns;
competing products;
sale to third parties;
political outreach;
personal solicitation; or
unrelated commercial activity.

38. Customer Contact Lists

An Advisor may not copy Nuveda AI customer or prospect lists into a personal contact database for unrelated use.

Contact information remains subject to applicable customer preferences and Nuveda AI policies.

39. Competitor Use

Advisors may not provide Nuveda AI customer or prospect information to a competitor or use restricted customer information to solicit competing business.

40. Confidential Company Information

Company information that is not public must be protected.

This may include:

internal pricing strategies;
sales records;
product roadmaps;
technical architecture;
vendor information;
security information;
financial data;
customer lists;
internal policies;
unpublished product information; and
other non-public information.

41. Security Information

Advisors must take particular care with information relating to:

vulnerabilities;
infrastructure;
authentication systems;
network architecture;
API secrets;
encryption keys;
access controls;
security incidents;
audit information;
penetration-testing results; or
other security-sensitive information.

Such information should not be publicly disclosed without authorization.

42. API Keys and Tokens

If an Advisor is ever provided with an API key, token, or similar credential, it must be:

protected;
used only as authorized;
not shared publicly;
not embedded in public content;
revoked when no longer needed; and
immediately reported if compromised.

43. Customer Credentials Received Accidentally

If a customer accidentally provides a password, API key, token, or other sensitive credential to an Advisor, the Advisor should:

avoid unnecessary use;
notify the appropriate Nuveda AI contact;
advise the customer to rotate or replace the credential where appropriate; and
securely delete the credential when no longer needed.

44. Access Reviews

Nuveda AI may periodically review Advisor access to systems and customer information.

Nuveda AI may revoke access that is:

no longer required;
excessive;
unused;
insecure;
associated with inactivity;
or inconsistent with the Advisor’s current responsibilities.

45. Role Changes

If an Advisor’s role, customer assignments, certification, or status changes, access permissions may be adjusted accordingly.

46. Inactive Advisors

Nuveda AI may restrict system or data access when an Advisor becomes Inactive under the Active Advisor & Inactivity Policy.

This may include restricting:

customer records;
new leads;
CRM functions;
email;
Advisor Center;
data exports; or
other systems.

47. Suspended Advisors

Nuveda AI may immediately restrict access during a suspension where necessary to protect:

customers;
data;
systems;
confidential information;
security; or
evidence relevant to an investigation.

48. Terminated Advisors

Upon resignation or termination, the former Advisor’s authorization to access Nuveda AI systems and customer information ends unless Nuveda AI expressly provides otherwise.

Nuveda AI may immediately revoke:

Advisor Center access;
CRM access;
email access;
aliases;
file access;
customer access;
internal communications;
APIs;
authentication sessions; and
other Program credentials.

49. Offboarding

Upon termination or Nuveda AI request, an Advisor must reasonably:

stop accessing Company systems;
return Company property;
delete unauthorized local copies of customer information;
delete confidential Company files no longer authorized;
remove Company accounts from personal devices where required;
cease using Nuveda AI email or aliases;
return customer records where appropriate;
and follow reasonable offboarding instructions.

50. Certification of Deletion

Nuveda AI may require a former Advisor to confirm that restricted customer or Company information has been deleted or returned.

Such confirmation must be truthful.

51. Retention Required by Law

If an Advisor is legally required to retain specific information after termination, the Advisor may retain only the information legally necessary and must continue to protect it.

52. Security Incident

A “Security Incident” may include:

unauthorized account access;
lost or stolen devices;
compromised credentials;
phishing;
malware;
unauthorized disclosure;
accidental customer-data disclosure;
unauthorized downloads;
suspicious account activity;
identity compromise;
data sent to the wrong person;
unauthorized AI-tool use involving customer information; or
other events that may compromise confidentiality, integrity, or availability.

53. Incident Reporting

An Advisor must report a suspected Security Incident involving Nuveda AI or customer information promptly after becoming aware of it.

The Advisor should not delay reporting merely because all facts are not yet known.

54. What to Include in an Incident Report

Where known, the Advisor should provide:

what happened;
when it occurred;
systems involved;
information potentially affected;
persons involved;
actions already taken; and
any relevant evidence.

The Advisor should not fabricate or conceal information.

55. Preservation of Evidence

Advisors should avoid destroying relevant evidence relating to a suspected Security Incident.

Nuveda AI may request preservation of:

emails;
logs;
screenshots;
messages;
files;
device information; or
other relevant records.

56. No Unauthorized Public Disclosure of Incidents

Advisors may not publicly disclose confidential details of an actual or suspected Security Incident without authorization, except where legally protected or required.

Public disclosure may interfere with investigation or customer protection.

57. Security Investigations

Advisors must reasonably cooperate with legitimate security investigations.

Nuveda AI may require:

password resets;
account logout;
device review information;
credential revocation;
temporary access restriction;
or other reasonable containment measures.

58. Breach Notification

Nuveda AI will determine whether customer, regulator, governmental, contractual, or other notification is required after a Security Incident.

An Advisor may not independently make official breach notifications on behalf of Nuveda AI unless authorized.

59. Physical Security

Advisors must reasonably protect devices, printed documents, notebooks, and other materials containing customer or Company information from unauthorized physical access.

60. Workspace Privacy

Advisors should avoid displaying confidential customer information where unauthorized persons can easily view it.

Reasonable precautions may include:

screen locking;
secure workspace practices;
privacy screens where appropriate; and
secure document storage.

61. Family and Household Access

Use of a personal home office does not authorize family members or household members to access Nuveda AI systems or customer information.

62. Subcontractors and Assistants

An Advisor may not give a personal assistant, subcontractor, virtual assistant, or other third party access to Nuveda AI systems or customer information unless Nuveda AI has authorized that access.

63. Cross-Border Data

Advisors may not independently transfer or store customer information in another country using unapproved services or processes where doing so may create privacy, contractual, or compliance concerns.

64. Data Residency

An Advisor may not promise or alter customer data-residency arrangements.

Any specific customer data-residency requirement must be handled through authorized Nuveda AI processes.

65. Regulated Customer Information

If an opportunity involves information subject to specialized regulatory requirements, the Advisor must seek appropriate Nuveda AI guidance before collecting or processing such information.

Examples may include certain:

health information;
financial information;
government information;
educational records;
or other regulated data.

66. No Independent Security Guarantees

Advisors may not make independent guarantees concerning:

encryption;
breach prevention;
system architecture;
security certifications;
data storage;
data deletion;
access controls;
vulnerability management;
disaster recovery; or
other security matters.

Only current approved Nuveda AI representations may be used.

67. SOC 2 and Audit Information

Advisors may not distribute confidential SOC 2 reports, audit materials, security questionnaires, penetration-test information, or similar documentation unless authorized.

Customer security requests should be routed through the appropriate Nuveda AI process.

68. Customer Security Questionnaires

Advisors may assist in routing customer security questionnaires but should not independently answer technical or legal security questions beyond approved information.

69. Forward-Deployed Engineer Support

Where customer requirements become technical, security-sensitive, architectural, or integration-heavy, the Advisor should involve the appropriate Nuveda AI technical or Forward-Deployed Engineer resource.

70. Data Accuracy

Advisors should make reasonable efforts to keep customer and prospect information accurate.

Knowingly falsifying customer records is prohibited.

71. Data Correction

If an Advisor becomes aware that a material customer record is inaccurate, the Advisor should correct it through an authorized process where appropriate.

72. Deletion Requests

Customer privacy or deletion requests should be routed through Nuveda AI’s authorized privacy process where appropriate.

Advisors should not independently promise deletion timelines or outcomes beyond their authority.

73. Access Requests

Customer requests to access personal information should be routed through the applicable Nuveda AI privacy process where necessary.

74. Legal Requests

If an Advisor receives a subpoena, court order, law-enforcement request, or other legal demand involving Nuveda AI or customer information, the Advisor should promptly notify Nuveda AI unless legally prohibited from doing so.

Advisors may not respond on behalf of Nuveda AI without authorization.

75. Security Training

Nuveda AI may require Advisors to complete periodic:

security training;
privacy training;
phishing awareness;
data-handling training;
or other relevant education.

Failure to complete mandatory training may affect Active Advisor Status or system access.

76. Periodic Reauthentication

Nuveda AI may require periodic:

password changes where appropriate;
MFA confirmation;
identity re-verification;
device confirmation;
policy acknowledgment; or
other security measures.

77. Monitoring and Logging

Nuveda AI may log and monitor use of Company-managed systems as permitted by applicable law for:

security;
fraud prevention;
compliance;
troubleshooting;
customer protection;
access management; and
investigation of misuse.

78. No Evasion of Security Controls

Advisors may not intentionally:

bypass access restrictions;
disable logging;
evade monitoring;
bypass authentication;
defeat rate limits;
conceal unauthorized access; or
interfere with security controls.

79. Vulnerability Discovery

If an Advisor discovers a possible Nuveda AI vulnerability, the Advisor should report it through an appropriate internal channel.

The Advisor may not exploit, publicize, or sell the vulnerability without authorization.

80. Customer System Access

An Advisor should not log into or administer customer systems unless expressly authorized and necessary for the Advisor’s approved role.

Technical implementation should be handled by appropriately authorized personnel.

81. Export Control and Sanctions

Advisors must comply with applicable restrictions concerning access to technology, data, or services in sanctioned or restricted contexts.

Questions should be escalated to Nuveda AI where appropriate.

82. Violations

Violations of this Policy may result in:

corrective training;
access restriction;
warning;
recertification;
temporary suspension;
lead restriction;
removal from customer accounts;
or termination.

83. Serious Security Violations

Conduct that may justify immediate suspension or termination includes:

deliberate customer-data theft;
selling customer information;
deliberate credential sharing;
serious unauthorized access;
intentional security bypass;
malicious system activity;
deliberate disclosure of confidential information;
significant unauthorized bulk export;
knowingly sending customer data to prohibited systems;
intentional misuse of payment information;
or other serious security misconduct.

84. No Automatic Commission Forfeiture

Violation of this Policy does not automatically eliminate commissions already legally earned.

Commission consequences remain governed by:

the Business Advisor Agreement;
Commission & Customer Attribution Policy;
Suspension & Termination Policy;
the validity of the underlying transaction; and
applicable law.

Fraudulent or invalid transactions do not create legitimate commission rights.

85. Indemnification and Remedies

Violations involving unauthorized disclosure, unlawful conduct, fraud, or misuse of customer information may also trigger remedies available under the Business Advisor Agreement and applicable law.

86. Policy Modifications

Nuveda AI may update this Policy prospectively where reasonably necessary to reflect:

technology changes;
security risks;
privacy requirements;
system changes;
customer requirements;
regulatory obligations;
Program changes; or
legitimate business needs.

Material changes affecting substantial contractual rights will be handled consistently with the Business Advisor Agreement.

87. Relationship to Other Program Documents

This Policy should be read together with:

Nuveda AI Business Advisor Agreement;
Commission & Customer Attribution Policy;
Active Advisor & Inactivity Policy;
Suspension & Termination Policy;
Advisor Code of Conduct;
Advertising, Social Media & Claims Policy;
Lead Registration & Customer Ownership Policy; and
Earnings & Opportunity Disclosure.

If this Policy conflicts with the Business Advisor Agreement concerning a material contractual provision, the Business Advisor Agreement controls unless a later validly accepted amendment expressly provides otherwise.

88. No Separate Signature

This Policy does not require:

handwritten signature;
paper execution;
separate electronic signature;
separate checkbox; or
separate acceptance.

It is incorporated into the Business Advisor Agreement.

89. Electronic Acceptance

The Advisor accepts this Policy when the Advisor electronically accepts the Nuveda AI Business Advisor Agreement.

Nuveda AI may maintain electronic records identifying:

Advisor or user ID;
Business Advisor Agreement version;
Security Policy version;
date and time of acceptance;
electronic acceptance event; and
other reasonable evidence of acceptance.

90. Electronic Acknowledgment

By electronically accepting the Nuveda AI Business Advisor Agreement, the Advisor acknowledges and agrees that:

this Customer Data & Security Policy forms part of that Agreement;
customer and prospect information may be used only for authorized Nuveda AI purposes;
Advisors should access only the minimum information reasonably necessary for their role;
credentials may not be shared;
required MFA and other security controls must not be bypassed;
customer passwords and sensitive payment credentials should not be collected through unauthorized channels;
Company email accounts, aliases, CRM access, and Advisor Center accounts remain under Nuveda AI control;
customer lists and CRM data may not be exported, copied, sold, or used for unrelated purposes without authorization;
customer information may not be uploaded to unauthorized AI tools, cloud-storage services, or third-party applications;
use of AI does not eliminate the Advisor's responsibility to protect confidential information;
lost devices, compromised credentials, phishing, unauthorized disclosure, and other suspected Security Incidents must be reported promptly;
Nuveda AI may restrict access during inactivity, suspension, investigation, or termination;
former Advisors must stop accessing Company systems and return or delete restricted information as required;
serious customer-data misuse or security violations may result in immediate suspension or termination; and
commissions already legally earned are not automatically forfeited solely because a security-policy violation occurs.

No separate signature or separate electronic acceptance of this Policy is required.

The Advisor's electronic acceptance of the Nuveda AI Business Advisor Agreement constitutes acceptance of this Policy.

NUVEDA AI LLC Nuveda AI Business Advisor Program Huntersville, North Carolina, United States