Privacy Policy

Effective Date: March 19, 2026

1. Information We Collect

Personal Information

To process your fund enrollment, verify your identity, and comply with applicable securities and anti-money laundering regulations, we collect the following categories of personal information:

• Identity and Contact Information: Full legal name, email address, phone number, residential address, and mailing address.
• Tax Information: Social Security Number (SSN), Employer Identification Number (EIN), Individual Taxpayer Identification Number (ITIN), tax classification, and information required for IRS Forms W-9 and W-8BEN/W-8BEN-E. This information is collected through our enrollment forms.
• Financial and Accreditation Information: Capital commitment amount, subscription period, accredited investor qualification basis (net worth, income thresholds, or professional certifications), and investment preferences.
• Entity Information: For trusts, companies, and funds subscribing to the Fund: legal entity name, entity type (LLC, corporation, partnership, trust, etc.), jurisdiction and date of formation, EIN, beneficial owner details, and authorized signatory information.
• Accredited Investor Verification: Documentation and self-certifications regarding your status as an accredited investor under Rule 501 of Regulation D.

Financial Account Information (via Plaid)

If you choose to link a bank account through our Platform, we use Plaid, Inc. ("Plaid") to facilitate the connection. When you connect your bank account via Plaid, the following occurs:

• What Plaid collects: Plaid may collect your bank login credentials, account balances, transaction history, and other financial data directly from your financial institution. Plaid's collection and use of this data is governed by Plaid's End User Privacy Policy.
• What we store: We store only the information necessary for fund operations: the financial institution name, a masked account number (last four digits only), the account holder name, the account type, and a Plaid access token. We do not store your bank login credentials, full account numbers, account balances, or transaction history.
• Access tokens: Plaid access tokens are encrypted at rest using industry-standard encryption and are stored in our secure database. These tokens allow us to verify your account for capital calls and distributions without requiring you to re-authenticate.
• Purpose: Bank account information is used solely for facilitating capital calls and distributing fund proceeds. It is never used for any other purpose.

Authentication Data

We use Google OAuth for authentication. When you sign in with Google, we receive your name, email address, and profile image. We do not receive or store your Google password. Google's handling of your data is subject to Google's Privacy Policy.

Usage Data

When you access our Platform, we may automatically collect certain information about your device and usage, including IP address, browser type, operating system, access times, and pages viewed. This information helps us maintain and improve the Platform and detect security threats.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Fund Enrollment and Onboarding: To process your subscription agreement, verify your identity, confirm your accredited investor status, and complete your enrollment in Region Cuatro, LP.
• Electronic Signatures: To facilitate the electronic execution of your Subscription Agreement and related tax forms through DocuSign or Documenso.
• Bank Account Verification: To verify bank accounts linked via Plaid for the purpose of processing capital calls and fund distributions.
• Fund Administration and Reporting: To manage your investment, process capital calls and distributions, prepare Schedule K-1 tax statements, and provide quarterly fund reports and LP portfolio reporting.
• Investor Communications: To send you important notices about your investment, including capital call notices, distribution notices, tax documents, fund updates, and deal pipeline information.
• Regulatory Compliance: To comply with anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, IRS reporting obligations, and other applicable securities laws.
• Enrollment Assistance: To provide AI-assisted enrollment support through our chat interface, powered by OpenAI. No financial data, tax information, or bank account details are shared with OpenAI. Only general enrollment context (such as form navigation steps and general fund information) is transmitted.
• Platform Operations: To maintain, improve, and secure our Platform and services, and to prevent fraud or unauthorized access.

3. Third-Party Services

We work with the following third-party service providers. Each provider receives only the minimum information necessary to perform its function:

Plaid (Bank Account Verification)

Plaid provides bank account verification and linking services. When you connect your bank account, Plaid acts as an intermediary between you and your financial institution. Plaid's own privacy policy governs Plaid's collection and use of your financial data. We receive from Plaid only the institution name, masked account number, account holder name, and account type. We also store an encrypted Plaid access token to maintain the connection. We do not access your bank account balances or transaction history.

DocuSign and Documenso (Electronic Signatures)

We use DocuSign and/or Documenso to process electronic signatures on subscription agreements and tax forms. These services receive your name, email address, and the documents you are signing. Their handling of your data is governed by their respective privacy policies.

Google (Authentication)

We use Google OAuth solely for user authentication. We receive your name, email address, and profile image from Google. We do not access your Google contacts, calendar, drive, or any other Google services.

OpenAI (Enrollment Assistance)

We use OpenAI to power our chat-based enrollment assistant. No financial data (investment amounts, bank account information, SSN/EIN, or accreditation details) is shared with OpenAI. The assistant is provided only with general fund information and enrollment workflow context to help guide you through the process.

Other Service Providers

We may also share information with cloud hosting providers, fund administrators, accountants, legal counsel, and other professional advisors who assist in fund operations. All service providers are bound by contractual obligations to protect your information and use it only for the purposes for which it was disclosed.

4. Information Sharing and Disclosure

We may disclose your information in the following circumstances:

• Service Providers: To third-party service providers who assist us in operating the Platform and administering the Fund, as described in Section 3 above.
• Legal and Regulatory: To regulatory authorities, the IRS, the SEC, or other government agencies as required by law, or in response to valid legal process such as subpoenas or court orders.
• Fund Administration: To fund administrators, auditors, and legal counsel who require access to investor information for fund operations, tax reporting, and compliance purposes.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the successor entity. We will notify you of any such change.
• With Your Consent: We may share your information for other purposes with your explicit consent.

5. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or financial data to third parties for marketing or any other purpose. This includes all data collected directly from you, data obtained through Plaid, and data received from any other third-party service. This commitment applies to all categories of personal information we collect, including financial account information, tax information, and investment data.

6. Data Security

We implement comprehensive technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our information security program includes:

• Encryption: All data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption algorithms. Plaid access tokens and other sensitive credentials are encrypted with application-level encryption before storage.
• Access Controls: Access to personal and financial information is restricted to authorized personnel on a need-to-know basis. Authentication is enforced via Google OAuth with session management controls.
• Infrastructure Security: Our Platform is hosted on secure cloud infrastructure with network-level security controls, firewalls, and intrusion detection systems.
• Information Security Policies: We maintain documented information security policies and procedures designed to identify, assess, mitigate, and monitor risks to the confidentiality, integrity, and availability of personal and financial data.
• Risk Assessment: We conduct regular security reviews and risk assessments to evaluate the effectiveness of our security controls and identify areas for improvement.
• Incident Response: We maintain incident response procedures to promptly detect, investigate, contain, and remediate security incidents. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.
• Vendor Security: We evaluate the security practices of our third-party service providers and require contractual commitments to maintain appropriate security measures.

While we implement commercially reasonable security measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to continuously improving our security posture.

7. Data Retention and Deletion

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected and to comply with legal, accounting, and regulatory requirements:

• Subscription and Fund Documents: Retained for the life of the Fund plus the applicable statute of limitations period (typically 7 years after fund dissolution).
• Tax Records (W-9, W-8BEN, K-1s): Retained for at least 7 years as required by IRS regulations.
• AML/KYC Records: Retained for at least 5 years after termination of the investor relationship.
• Plaid Access Tokens and Bank Account Data: Retained for as long as you maintain a linked bank account. You may request revocation of Plaid access at any time by contacting us at [email protected]. Upon revocation, we will delete the Plaid access token and associated bank account data, except where retention is required for existing transaction records or regulatory compliance.
• Usage Data: Retained for up to 2 years for security and analytics purposes.

When personal information is no longer required, we securely delete or anonymize it in accordance with our data retention policies.

8. Your Rights

You have the following rights with respect to your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request deletion of your personal information, subject to our legal and regulatory retention obligations. Certain data required for tax reporting, securities compliance, or active fund administration may not be eligible for deletion.
• Revoke Third-Party Access: You may revoke Plaid's access to your bank account at any time by contacting us. We will delete the stored access token and associated bank account data. You may also revoke Google OAuth access through your Google account settings.
• Portability: You may request a copy of your data in a structured, machine-readable format.
• Opt Out of Non-Essential Communications: You may opt out of non-essential communications (such as marketing or general updates) at any time. Note that you cannot opt out of essential fund communications such as capital call notices, distribution notices, and tax documents, as these are required for fund operations and regulatory compliance.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

9. California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect and how it is used, the right to request deletion, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights. Certain information collected for securities law compliance purposes may be exempt from these rights.

10. International Data Transfers

Our Platform is operated in the United States. If you are accessing our Platform from outside the United States, your information may be transferred to, stored, and processed in the United States. By using our Platform, you consent to the transfer of your information to the United States.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable laws. We will notify you of material changes by posting the updated policy on our Platform with a revised effective date. For significant changes affecting how we handle financial data or third-party service providers, we will also notify you by email. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a security concern, please contact us at:

Region Cuatro, LP
Email: [email protected]