1. What Are Cookies?

Cookies are small text files that are placed on your computer or mobile device when you visit a website. They are widely used to make websites work more efficiently, provide a better browsing experience, and give website owners useful information about how visitors use their site.

This Cookie Policy explains how Alethiom LLC (“Alma,” “we,” “us,” or “our”) uses cookies and similar technologies on our website (heyalma.ai). This policy applies to our public-facing website only. Tracking technologies used within the Alma mobile application (such as device identifiers and Firebase SDKs) are described in our Privacy Policy.

2. Types of Cookies We Use

We use two categories of cookies on our website: strictly necessary cookies and analytics cookies. We do not use advertising, marketing, social media tracking, or retargeting cookies. If this changes in the future, we will update this Cookie Policy and obtain your consent where required.

3. Cookie Inventory

The following is a complete list of cookies used on heyalma.ai:

3.1 Strictly Necessary Cookies

These cookies are essential for the website to function properly. They enable core functionality such as security, session management, and accessibility. You cannot opt out of strictly necessary cookies, as they are required for the operation of our website. These cookies are set automatically when you visit the site.

• alma_session. Provider: Alma. Purpose: Maintains your authenticated session while you browse the site. Type: Session cookie. Duration: Expires when you close your browser.

• alma_csrf. Provider: Alma. Purpose: Prevents cross-site request forgery attacks on form submissions. Type: Session cookie. Duration: Expires when you close your browser.

• alma_cookie_consent. Provider: Alma. Purpose: Remembers your cookie consent preferences so you are not asked again on each visit. Type: Persistent cookie. Duration: 1 year.

3.2 Analytics Cookies

These cookies help us understand how visitors interact with our website. Analytics cookies are not set unless you affirmatively consent via our cookie consent banner. If you dismiss the banner without making a choice, no analytics cookies are placed.

• _ga. Provider: Google Analytics. Purpose: Distinguishes unique visitors by assigning a randomly generated pseudonymous client ID. Type: Persistent cookie. Duration: 2 years.

• _ga_<container-id>. Provider: Google Analytics (GA4). Purpose: Maintains session state for GA4 measurement. Type: Persistent cookie. Duration: 2 years.

• _gid. Provider: Google Analytics. Purpose: Distinguishes unique visitors for analytics aggregation within a 24-hour window. Type: Persistent cookie. Duration: 24 hours.

4. How We Use Analytics Cookies

We use Google Analytics (GA4) to collect pseudonymized information about how visitors use our public website. Google Analytics cookies gather data such as:

• Which pages you visit and how long you spend on each page.

• How you arrived at our website (e.g., search engine, direct link, referral).

• Your general geographic location (city/region level, not precise location).

• Your device type, browser, and operating system.

4.1 Google Analytics Configuration

We have configured Google Analytics with the following privacy-protective settings:

• IP Anonymization: Enabled. Your IP address is truncated before storage.

• Data Sharing with Google: Disabled. We have turned off all optional data sharing settings in our GA4 configuration, including Google Signals, advertising features, and benchmarking.

• Google Signals: Disabled. We do not use Google Signals for cross-device tracking or audience building.

• Data Retention: Set to 14 months, after which event-level data is automatically deleted from Google’s servers.

• Advertising Features: All advertising and remarketing features are disabled.

• Scope: Google Analytics runs only on our public, unauthenticated marketing pages (heyalma.ai). GA does not run on any authenticated pages, account dashboards, or any pages that display or transmit health data, wellness information, or Protected Health Information (PHI).

4.2 Data Transmitted to Google

When analytics cookies are active, pseudonymized browsing data is transmitted to Google’s servers in the United States for processing. This data includes the randomly generated client ID stored in the _ga cookie, page URLs visited, referral source, device/browser information, and truncated IP address. Although this data is pseudonymized and not directly linked to your name or email, the client ID constitutes a unique identifier, which may be considered personal information under certain privacy laws (including CPRA). We do not use analytics data to identify individual users, and Google is contractually prohibited from using Alma’s analytics data for its own advertising purposes under our GA4 data processing terms.

For more information about how Google processes data, visit: https://policies.google.com/privacy

5. Your Choices

You have several options for managing cookies:

5.1 Cookie Consent Banner

When you first visit heyalma.ai, you will be presented with a cookie consent banner that allows you to accept or decline analytics cookies. Your preferences will be remembered for future visits via the alma_cookie_consent cookie.

Important: Analytics cookies are not set until you affirmatively click “Accept” on the banner. If you dismiss the banner without making a choice, close the banner, or simply continue browsing, no analytics cookies will be placed. You may change your cookie preferences at any time by clicking the “Cookie Preferences” link in our website footer.

5.2 Browser Settings

Most web browsers allow you to control cookies through their settings. You can typically set your browser to block or delete cookies, or to alert you when a cookie is being placed. Note that blocking all cookies, including strictly necessary cookies, may affect the functionality of our website.

5.3 Google Analytics Opt-Out

In addition to declining analytics cookies via our banner, you can opt out of Google Analytics across all websites by installing the Google Analytics Opt-Out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout

6. Do Not Track and Global Privacy Control

6.1 Do Not Track (DNT)

Some web browsers transmit “Do Not Track” (DNT) signals to websites. There is currently no universally accepted standard for how websites should respond to DNT signals. At this time, our website does not respond to DNT browser signals. However, you may use the cookie management options described in Section 5 to control tracking on our website.

6.2 Global Privacy Control (GPC)

We recognize and honor Global Privacy Control (GPC) signals as a valid opt-out request under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA). If your browser transmits a GPC signal when you visit heyalma.ai, we will treat this as a request to opt out of any processing that constitutes “selling” or “sharing” of personal information as defined under CPRA, and analytics cookies will not be set. For more information about GPC, visit: https://globalprivacycontrol.org

7. State Privacy Rights

7.1 Virginia (VCDPA)

If you are a Virginia resident, you have the right to opt out of the processing of your personal data for targeted advertising and profiling under the Virginia Consumer Data Protection Act (VCDPA). We do not use cookies for targeted advertising. We do not use cookies for profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers. You may opt out of analytics cookies at any time using the methods described in Section 5.

7.2 California (CCPA/CPRA)

If you are a California resident, you have the right to know about the personal information collected through cookies and to opt out of the sale or sharing of personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).

We do not sell personal information collected through cookies. With our current GA4 configuration (Google Signals disabled, data sharing disabled, advertising features disabled), we do not believe our use of Google Analytics constitutes “sharing” of personal information for cross-context behavioral advertising under CPRA. However, out of an abundance of caution, we honor GPC signals as described in Section 6.2, and you may opt out of analytics cookies entirely using the methods described in Section 5.

For the categories of personal information collected through cookies and their purposes, please refer to Section 10.4 of our Privacy Policy (Notice at Collection).

8. Mobile Application Tracking Technologies

This Cookie Policy applies to our website (heyalma.ai) only. Our mobile application uses tracking technologies that function similarly to cookies, including:

• Firebase Device Identifiers: Used for authentication and push notification delivery.

• Firebase Cloud Messaging (FCM) Tokens: Used to send push notifications to your device.

• Device Fingerprint: Used for security and fraud detection.

These mobile tracking technologies are described in detail in Section 2.3 of our Privacy Policy. The mobile app does not use advertising SDKs, social media trackers, or third-party analytics SDKs.

9. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use or for other operational, legal, or regulatory reasons. When we make changes, we will update the “Last Updated” date at the top of this page. If we add new categories of cookies (such as advertising or marketing cookies), we will update this policy and present the cookie consent banner again to obtain your consent for the new cookie categories. We encourage you to review this Cookie Policy periodically.

10. Contact Us

If you have any questions about this Cookie Policy, please contact us at:

Alethiom LLC

1550 Wilson Blvd, Ste 700 PMB629

Arlington, VA 22209

Email: info@heyalma.ai

Privacy Officer: privacy@heyalma.ai